Feedback
Table Of Contents
set connection advanced-options
show crypto accelerator statistics
show crypto ipsec fragmentation
show crypto protocol statistics
show memory delayed-free-poisoner
show priority-queue statistics
show running-config aaa-server
show running-config aaa-server host
show running-config access-group
show running-config access-list
show running-config arp timeout
show running-config arp-inspection
show running-config auth-prompt
show running-config command-alias
show running-config console timeout
show running-config crypto dynamic-map
show running-config crypto ipsec
show running-config crypto isakmp
show running-config crypto map
show running-config domain-name
show running-config established
show running-config group-delimiter
show running-config group-policy
show running-config ip address
show running-config ip audit attack
show running-config ip audit info
show running-config ip audit interface
show running-config ip audit name
show running-config ip audit signature
show running-config ip local pool
show running-config ip verify reverse-path
show running-config mac-address-table
show running-config management-access
show running-config multicast-routing
show running-config nat-control
show running-config object-group
show running-config policy-map
show running-config port-forward
show running-config prefix-list
show running-config priority-queue
show running-config same-security-traffic
show running-config service-policy
show running-configuration smtps
show running-config snmp-server
show running-config sunrpc-server
show running-config tftp-server
show running-config tunnel-group
show running-configuration url-list
show running-config url-server
show running-config vpn load-balancing
show running-configuration vpn-sessiondb
show running-configuration webvpn
show service-policy inspect gtp
snmp-server enable trap remote-access
subject-name (crypto ca certificate map)
subject-name (crypto ca trustpoint)
sysopt connection permit-ipsec
S Commands
same-security-traffic
To permit communication between interfaces with equal security levels, use the same-security-traffic command in global configuration mode. To disable the same-security interfaces, use the no forms of this command.
same-security-traffic permit {inter-interface | intra-interface}
no same-security-traffic permit {inter-interface | intra-interface}
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Allowing communication between same security interfaces provides the following benefits:
•
•
You can also redirect incoming client VPN traffic back out through the same interface unencrypted as well as encrypted. If you send VPN traffic back out through the same interface unencrypted, you must enable NAT for the interface so that publically routable addresses replace your private ip addresses (unless you already use public ip addresses in your local ip address pool). The following example commands apply an interface PAT rule to traffic sourced from the client ip pool:
hostname(config)# ip local pool clientpool 192.168.0.10-192.168.0.100
hostname(config)# global (outside) 1 interface
hostname config)# nat (outside) 1 192.168.0.0 255.255.255.0
When the security appliance sends encrypted VPN traffic back out this same interface, however, NAT is optional. To apply NAT to all outgoing traffic, implement only the commands above. To exempt the VPN-to-VPN traffic from NAT, add commands (to the example above) that implement NAT exemption for VPN-to-VPN traffic, such as:hostname(config)# access-list nonat permit ip 192.168.0.0 255.255.255.0 192.168.0.0 255.255.255.0 hostname(config)# nat (outside) 0 access-list nonatSee the nat command for more information.
Examples
The following example shows how to enable the same-security interface communication:
hostname(config)# same-security-traffic permit inter-interfaceRelated Commands
show running-config same-security-traffic
Displays the same-security-traffic configuration.
sdi-pre-5-slave
To specify the IP address or name of an optional SDI AAA "slave" server to use for this host connection that uses a version of SDI prior to SDI version 5, use the sdi-pre-5-slave command in AAA-server host configuration mode. To remove this specification, use the no form of this command:
sdi-pre-5-slave host
no sdi-pre-5-slave
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
AAA-server Host
•
•
•
•
—
Command History
Usage Guidelines
This command is available for any host in an SDI AAA servergroup, but it is relevant only if the SDI version for the host is set to sdi-pre-5 in the sdi-version command. Prior to using this command, you must have configured the AAA server to use the SDI protocol.
The sdi-pre-5-slave command lets you identify an optional secondary server that is to be used if the primary server fails. The address specified by this command must be that of a server that is configured as a "slave" to the primary SDI server. In this situation, if you are using a pre-5 version, you must configure the sdi-pre-5-slave command so that the security appliance can access the appropriate SDI configuration record that is downloaded from the server. This is not an issue with version 5 and later versions.
Examples
The following example configures the AAA SDI server group "svrgrp1" that uses an SDI version prior to SDI version 5.
hostname(config)# aaa-server svrgrp1 protocol sdihostname(config-aaa-server-group)# aaa-server svrgrp1 host 192.168.10.10hostname(config-aaa-server-host)# sdi-version sdi-pre-5hostname(config-aaa-server-host)# sdi-pre-5-slave 209.165.201.31hostname(config-aaa-server-host)# exithostname(config)#Related Commands
sdi-version
To specify the version of SDI to use for this host connection, use the sdi-version command in AAA-server host configuration mode. To remove this specification, use the no form of this command:
sdi-version version
no sdi-version
Syntax Description
version
Specify the version of SDI to use.Valid values are:
sdi-5 - SDI version 5.0 (default)
sdi-pre-5 - SDI versions prior to 5.0
Defaults
The default version is sdi-5.
Command Modes
The following table shows the modes in which you can enter the command:
AAA-server host
•
•
•
•
—
Command History
Usage Guidelines
This command is valid only for SDI AAA servers. If you configure a secondary (failover) SDI AAA server, and if the SDI version for that server is earlier than version 5, you must also specify the sdi-pre-5-slave command
Examples
hostname(config)# aaa-server svrgrp1 protocol sdihostname(config-aaa-server-group)# aaa-server svrgrp1 host 1.2.3.4hostname(config-aaa-server-host)# timeout 6hostname(config-aaa-server-host)# retry-interval 7hostname(config-aaa-server-host)# sdi-version sdi-5hostname(config-aaa-server)# exithostname(config)#Related Commands
secondary
To give the secondary unit higher priority in a failover group, use the secondary command in failover group configuration mode. To restore the default, use the no form of this command.
secondary
no secondary
Syntax Description
This command has no arguments or keywords.
Defaults
If primary or secondary is not specified for a failover group, the failover group defaults to primary.
Command Modes
The following table shows the modes in which you can enter the command:
Failover group configuration
•
•
—
—
•
Command History
Usage Guidelines
Assigning a primary or secondary priority to a failover group specifies which unit the failover group becomes active on when both units boot simulataneously (within a unit polltime). If one unit boots before the other, then both failover groups become active on that unit. When the other unit comes online, any failover groups that have the second unit as a priority do not become active on the second unit unless the failover group is configured with the preempt command or is manually forced to the other unit with the no failover active command.
Examples
The following example configures failover group 1 with the primary unit as the higher priority and failover group 2 with the secondary unit as the higher priority. Both failover groups are configured with the preempt command, so the groups will automatically become active on their preferred unit as the units become available.
hostname(config)# failover group 1hostname(config-fover-group)# primaryhostname(config-fover-group)# preempt 100hostname(config-fover-group)# exithostname(config)# failover group 2hostname(config-fover-group)# secondaryhostname(config-fover-group)# preempt 100hostname(config-fover-group)# mac-address e1 0000.a000.a011 0000.a000.a012hostname(config-fover-group)# exithostname(config)#Related Commands
secondary-color
To set a secondary color for the WebVPN login, home page, and file access page, use the secondary-color command in webvpn mode. To remove a color from the configuration and reset the default, use the no form of this command.
secondary-color [color]
no secondary-color
Syntax Description
Defaults
The default secondary color is HTML #CCCCFF, a lavender shade.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn
•
•
—
—
•
Command History
Usage Guidelines
The number of RGB values recommended for use is 216, many fewer than the mathematical possibilities. Many displays can handle only 256 colors, and 40 of those look differently on MACs and PCs. For best results, check published RGB tables. To find RGB tables online, enter RGB in a search engine.
Examples
The following example shows how to set an HTML color value of #5F9EAO, which is a teal shade:
hostname(config)# webvpnhostname(config-webvpn)# secondary-color #5F9EAORelated Commands
title-color
Sets a color for the WebVPN title bar on the login, home page, and file access page
secondary-color
To set a secondary color for the WebVPN login, home page, and file access page, use the secondary-color command in webvpn mode. To remove a color from the configuration and reset the default, use the no form of this command.
secondary-color [color]
no secondary-color
Syntax Description
Defaults
The default secondary color is HTML #CCCCFF, a lavender shade.
Command Modes
The following table shows the modes in which you can enter the command:
Webvpn
•
•
—
—
•
Command History
Usage Guidelines
The number of RGB values recommended for use is 216, many fewer than the mathematical possibilities. Many displays can handle only 256 colors, and 40 of those look differently on MACs and PCs. For best results, check published RGB tables. To find RGB tables online, enter RGB in a search engine.
Examples
The following example shows how to set an HTML color value of #5F9EAO, which is a teal shade:
hostname(config)# webvpnhostname(config-webvpn)# secondary-color #5F9EAORelated Commands
title-color
Sets a color for the WebVPN title bar on the login, home page, and file access page
secure-unit-authentication
To enable secure unit authentication, use the secure-unit-authentication enable command in group-policy configuration mode. To disable secure unit authentication, use the secure-unit-authentication disable command. To remove the secure unit authentication attribute from the running configuration, use the no form of this command. This option allows inheritance of a value for secure unit authentication from another group policy.
Secure unit authentication provides additional security by requiring VPN hardware clients to authenticate with a username and password each time the client initiates a tunnel. With this feature enabled, the hardware client does not have a saved username and password.
Note
secure-unit-authentication {enable | disable}
no secure-unit-authentication
Syntax Description
Defaults
Secure unit authentication is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Group policy
•
—
•
—
—
Command History
Usage Guidelines
Secure unit authentication requires that you have an authentication server group configured for the tunnel group the hardware client(s) use.
If you require secure unit authentication on the primary security appliance, be sure to configure it on any backup servers as well.
Examples
The following example shows how to enable secure unit authentication for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# secure-unit-authentication enableRelated Commands
security-level
To set the security level of an interface, use the security-level command in interface configuration mode. To set the security level to the default, use the no form of this command. The security level protects higher security networks from lower security networks by imposing additional protection between the two.
security-level number
no security-level
Syntax Description
Defaults
By default, the security level is 0.
If you name an interface "inside" and you do not set the security level explicitly, then the security appliance sets the security level to 100 (see the nameif command). You can change this level if desired.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
•
•
•
—
Command History
7.0
This command was moved from a keyword of the nameif command to an interface configuration mode command.
Usage Guidelines
The level controls the following behavior:
•
For same security interfaces, there is an implicit permit for interfaces to access other interfaces on the same security level or lower.
•
–
–
•
For same security interfaces, you can filter traffic in either direction.
•
Without NAT control, or for same security interfaces, you can choose to use NAT between any interface, or you can choose not to use NAT. Keep in mind that configuring NAT for an outside interface might require a special keyword.
•
For same security interfaces, you can configure established commands for both directions.
Normally, interfaces on the same security level cannot communicate. If you want interfaces on the same security level to communicate, see the same-security-traffic command. You might want to assign two interfaces to the same level and allow them to communicate if you want to create more than 101 communicating interfaces, or you want protection features to be applied equally for traffic between two interfaces; for example, you have two departments that are equally secure.
If you change the security level of an interface, and you do not want to wait for existing connections to time out before the new security information is used, you can clear the connections using the clear local-host command.
Examples
The following example configures the security levels for two interfaces to be 100 and 0:
hostname(config)# interface gigabitethernet0/0hostname(config-if)# nameif insidehostname(config-if)# security-level 100hostname(config-if)# ip address 10.1.1.1 255.255.255.0hostname(config-if)# no shutdownhostname(config-if)# interface gigabitethernet0/1hostname(config-if)# nameif outsidehostname(config-if)# security-level 0hostname(config-if)# ip address 10.1.2.1 255.255.255.0hostname(config-if)# no shutdownRelated Commands
serial-number
To include the security appliance serial number in the certificate during enrollment, use the serial-number command in crypto ca trustpoint configuration mode. To restore the default setting, use the no form of the command.
serial-number
no serial-number
Syntax Description
Defaults
The default setting is to not include the serial number.
Command Modes
The following table shows the modes in which you can enter the command
Crypto ca trustpoint configuration
•
•
•
•
•
:
Command History
Examples
The following example enters crypto ca trustpoint configuration mode for trustpoint central, and includes the security appliance serial number in the enrollment request for trustpoint central:
hostname(config)# crypto ca trustpoint centralhostname(ca-trustpoint)# serial-numberhostname(ca-trustpoint)#Related Commands
server
To specify a default e-mail proxy server, use the server command in the applicable e-mail proxy mode. To remove the attribute from the configuration, use the no version of this command. The security appliance sends requests to the default e-mail server when the user connects to the e-mail proxy without specifying a server. If you do not configure a default server, and a user does not specify a server, the security appliance returns an error.
server {ipaddr or hostname}
no server
Syntax Description
hostname
The DNS name of the default e-mail proxy server.
ipaddr
The IP address of the default e-mail proxy server.
Defaults
There is no default e-mail proxy server by default.
Command Modes
The following table shows the modes in which you can enter the command:
Pop3s
•
•
—
—
•
Imap4s
•
•
—
—
•
Smtps
•
•
—
—
•
Command History
Examples
The following example shows how to set a default POP3S e-mail server with an IP address. of 10.1.1.7:
hostname(config)# pop3shostname(config-pop3s)# server 10.1.1.7
server-port
To configure a AAA server port for a host, use the server-port command in AAA-server host mode. To remove the designated server port, use the no form of this command:
server-port port-number
no server-port
Syntax Description
Defaults
The default server ports are as follows:
•
•
•
•
•
Command Modes
The following table shows the modes in which you can enter the command:
AAA-server group
•
•
•
•
—
Command History
Examples
The following example configures an SDI AAA server named "srvgrp1" to use server port number 8888:
hostname(config)# aaa-server srvgrp1 protocol sdihostname(config-aaa-server-group)# aaa-server srvgrp1 host 192.168.10.10hostname(config-aaa-server-host)# server-port 8888hostname(config-aaa-server-host)# exithostname(config)#Related Commands
server-separator
To specify a character as a delimiter between the e-mail and VPN server names, use server-separator command in the applicable e-mail proxy mode. To revert to the default, ":", use the no form of this command.
server-separator {symbol}
no server-separator
Syntax Description
symbol
The character that separates the e-mail and VPN server names. Choices are "@," (at) "|" (pipe), ":"(colon), "#" (hash), "," (comma), and ";" (semi-colon).
Defaults
The default is "@" (at).
Command Modes
The following table shows the modes in which you can enter the command:
Pop3s
•
—
•
—
—
Imap4s
•
—
•
—
—
Smtps
•
—
•
—
—
Command History
Usage Guidelines
The server separator must be different from the name separator.
Examples
The following example shows how to set a pipe (|) as the server separator for IMAP4S:
hostname(config)# imap4shostname(config-imap4s)# server-separator |Related Commands
service
To enable system services, use the service command in global configuration mode. To disable system services, use the no form of this command.
service {resetinbound | resetoutbound} [interface intf]
no service {resetinbound | resetoutbound}[interface intf]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Preexisting
This command was preexisting.
7.0(5)
This command was modified to include the interface keyword.
Usage Guidelines
The service command works with all inbound TCP connections to static interfaces whose access lists or uauth (user authorization) do not allow inbound connections. One use is for resetting identity request (IDENT) connections. If an inbound TCP connection is attempted and denied, you can use the service resetinbound command to return an RST (reset flag in the TCP header) to the source. Without the keyword, the security appliance drops the packet without returning an RST.
By default a RST is always sent to the inside host when outbound TCP traffic is denied. The keyword resetoutbound is used to change this default. For example, if traffic is outbound through the security appliance, and the no service resetoutbound command is configured globally or on that interface, we do not send RST.
With the optional interface keyword, the TCP reset is sent only when outbound packets are denied on that interface.
The security appliance sends a TCP RST to the host connecting inbound and stops the incoming IDENT process so that outbound e-mail can be transmitted without having to wait for IDENT to time out. The security appliance sends a syslog message stating that the incoming connection was denied. Without entering the service resetinbound command, the security appliance drops packets that are denied and generates a syslog message stating that the SYN was denied. However, outside hosts keep retransmitting the SYN until the IDENT times out.
When an IDENT connection times out, the connections slow down. Perform a trace to determine that IDENT is causing the delay and then enter the service command.
Use the service resetinbound command to handle an IDENT connection through the security appliance. These methods for handling IDENT connections are ranked from most secure to the least secure:
1.
2.
3.
When using the aaa command, if the first attempt at authorization fails and a second attempt causes a timeout, use the service resetinbound command to reset the client that failed the authorization so that it will not retransmit any connections. An example authorization timeout message in Telnet is as follows:
Unable to connect to remote host: Connection timed outThe following is the expected behavior of traffic on the security appliance in regards to the reset flag.
1.
2.
3.
If you use the resetoutside command, the security appliance actively resets denied TCP packets that terminate at the security appliances least-secure interface. By default, these packets are silently discarded. We recommend that you use the resetoutside keyword with dynamic or static interface Port Address Translation (PAT). The static interface PAT is available with security appliance version 6.0 and higher. This keyword allows the security appliance to terminate the IDENT from an external SMTP or FTP server. Actively resetting these connections avoids the 30-second timeout delay.
Examples
The following example shows how to enable system services:
hostname/context_name(config)# service resetinboundThis example shows how to enable system services on an interface called dmz1:
hostname/context_name(config)# service resetinbound interface dmz1Related Commands
service password-recovery
To enable password recovery, use the service password-recovery command in global configuration mode. To disable password recovery, use the no form of this command. Password recovery is enabled by default, but you might want to disable it to ensure that unauthorized users cannot use the password recovery mechanism to compromise the security appliance.
service password-recovery
no service password-recovery
Syntax Description
This command has no arguments or keywords.
Defaults
Password recovery is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
•
Command History
Usage Guidelines
On the ASA 5500 series adaptive security appliance, if you forget the passwords, you can boot the security appliance into ROMMON by pressing the Escape key on the terminal keyboard when prompted during startup. Then set the security appliance to ignore the startup configuration by changing the configuration register (see the config-register command). For example if your configuration register is the default 0x1, then change the value to 0x41 by entering the confreg 0x41 command. After reloading the security appliance, it loads a default configuration, and you can enter privileged EXEC mode using the default passwords. Then load the startup configuration by copying it to the running configuration and reset the passwords. Finally, set the security appliance to boot as before by setting the configuration register to the original setting. For example, enter the config-register 0x1 command in global configuration mode.
On the PIX 500 series security appliance, boot the security appliance into monitor mode by pressing the Escape key on the terminal keyboard when prompted during startup. Then download the PIX password tool to the security appliance, which erases all passwords and aaa authentication commands.
On the ASA 5500 series adaptive security appliance, the no service password-recovery command prevents a user from entering ROMMON with the configuration intact. When a user enters ROMMON, the security appliance prompts the user to erase all Flash file systems. The user cannot enter ROMMON without first performing this erasure. If a user chooses not to erase the Flash file system, the security appliance reloads. Because password recovery depends on using ROMMON and maintaining the existing configuration, this erasure prevents you from recovering a password. However, disabling password recovery prevents unauthorized users from viewing the configuration or inserting different passwords. In this case, to recover the system to an operating state, load a new image and a backup configuration file, if available. The service password-recovery command appears in the configuration file for informational purposes only; when you enter the command at the CLI prompt, the setting is saved in NVRAM. The only way to change the setting is to enter the command at the CLI prompt. Loading a new configuration with a different version of the command does not change the setting. If you disable password recovery when the security appliance is configured to ignore the startup configuration at startup (in preparation for password recovery), then the security appliance changes the setting to boot the startup configuration as usual. If you use failover, and the standby unit is configured to ignore the startup configuration, then the same change is made to the configuration register when the no service password recovery command replicates to the standby unit.
On the PIX 500 series security appliance, the no service password-recovery command forces the PIX password tool to prompt the user to erase all Flash file systems. The user cannot use the PIX password tool without first performing this erasure. If a user chooses not to erase the Flash file system, the security appliance reloads. Because password recovery depends on maintaining the existing configuration, this erasure prevents you from recovering a password. However, disabling password recovery prevents unauthorized users from viewing the configuration or inserting different passwords. In this case, to recover the system to an operating state, load a new image and a backup configuration file, if available.
Examples
The following example disables password recovery for the ASA 5500 series adaptive security appliance:
hostname(config)# no service password-recoveryWARNING: Executing "no service password-recovery" has disabled the password recovery mechanism and disabled access to ROMMON. The only means of recovering from lost or forgotten passwords will be for ROMMON to erase all file systems including configuration files and images. You should make a backup of your configuration and have a mechanism to restore images from the ROMMON command line.The following example disables password recovery for the PIX 500 series security appliance:
hostname(config)# no service password-recoveryWARNING: Saving "no service password-recovery" in the startup-config will disable password recovery via the npdisk application. The only means of recovering from lost or forgotten passwords will be for npdisk to erase all file systems including configuration files and images. You should make a backup of your configuration and have a mechanism to restore images from the Monitor Mode command line.The following example for the ASA 5500 series adaptive security appliance shows when to enter ROMMON at startup and how to complete a password recovery operation.
Use BREAK or ESC to interrupt boot.Use SPACE to begin boot immediately.Boot interrupted.Use ? for help.rommon #0> confregCurrent Configuration Register: 0x00000001Configuration Summary:boot default image from FlashDo you wish to change this configuration? y/n [n]: nrommon #1> confreg 0x41Update Config Register (0x41) in NVRAM...rommon #2> bootLaunching BootLoader...Boot configuration file contains 1 entry.Loading disk0:/ASA_7.0.bin... Booting...###################...Ignoring startup configuration as instructed by configuration register.Type help or '?' for a list of available commands.hostname> enablePassword:hostname# configure terminalhostname(config)# copy startup-config running-configDestination filename [running-config]?Cryptochecksum(unchanged): 7708b94c e0e3f0d5 c94dde05 594fbee9892 bytes copied in 6.300 secs (148 bytes/sec)hostname(config)# enable password NewPasswordhostname(config)# config-register 0x1Related Commands
config-register
Sets the security appliance to ignore the startup configuration when it reloads.
enable password
Sets the enable password.
password
Sets the login password.
service-policy
To activate a policy map globally on all interfaces or on a targeted interface, use the service-policy command in privileged EXEC mode. To disable, use the no form of this command. Use the service-policy command to enable a set of policies on an interface. In general, a service-policy command can be applied to any interface that can be defined by the nameif command.
service-policy policymap_name [ global | interface intf ]
no service-policy policymap_name [ global | interface intf ]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
If an interface name is specified, the policy-map only applies to the interface. The interface name is defined in the nameif command, and an interface policy-map overrides a global policy-map. Only one policy-map is allowed per interface.
Only one global policy is allowed.
Examples
The following example shows the syntax of the service-policy command:
hostname(config)# service-policy outside_security_map outsideRelated Commands
session
To establish a Telnet session to an AIP SSM, use the session command in privileged EXEC mode.
session 1
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
This command is only available when the AIP SSM is in the Up state. See the show module command for state information.
To end a session, enter exit or Ctrl-Shift-6 then the X key.
Examples
The following example sessions to an SSM in slot 1:
hostname# session 1Opening command session with slot 1.Connected to slot 1. Escape character sequence is 'CTRL-^X'.Related Commands
set connection
To specify connection values within a policy-map for a traffic class, use the set connection command in class mode. Use this command to specify the maximum number of simultaneous connections and to specify whether to enable or disable TCP sequence number randomization. To remove these specifications, thereby allowing unlimited connections, use the no form of this command.
set connection {conn-max | embryonic-conn-max} n random-seq# {enable | disable}
no set connection {conn-max | embryonic-conn-max} n random-seq# {enable | disable}
Syntax Description
Defaults
For both the conn-max and embryonic-conn-max parameters, the default value of n is 0, which allows unlimited connections.
Sequence number randomization is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Class
•
•
—
—
•
Command History
Usage Guidelines
You must have configured the policy-map command and the class command before issuing this command.
Note
When a traffic class is subject to a connection limit or embryonic connection limit from both the MPC set connection command and the nat/static command, then whichever limit is reached, that limit is applied.
When a TCP traffic class is configured to have sequence number randomization disabled by either the MPC set connection command or the nat/static command, then sequence number randomization is disabled.Examples
The following is an example of the use of the set connection command in class mode to configure the maximum number of simultaneous connections as 256 and to disable TCP sequence number randomization:
hostname(config)# policy-map localpolicy1hostname(config-pmap)# class local_serverhostname(config-pmap-c)# set connection conn-max 256 random-seq# disablehostname(config-pmap-c)# exitRelated Commands
set connection advanced-options
To specify advanced TCP connection options within a policy-map for a traffic class, use the set connection advanced-options command in class mode. To remove advanced TCP connection options for a traffic class within a policy map, use the no form of this command.
set connection advanced-options tcp-mapname
no set connection advanced-options tcp-mapname
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Class
•
•
—
—
•
Command History
Usage Guidelines
You must have configured the policy-map command and the class command, as well as the TCP map name, before issuing this command. See the description of the tcp-map command for detailed information.
Examples
The following example shows the use of the set connection advanced-options command to specify the use of a TCP map named localmap:
hostname(config)# access-list http-server permit tcp any host 10.1.1.1hostname(config)# class-map http-serverhostname(config-cmap)# match access-list http-serverhostname(config-cmap)# exithostname(config)# tcp-map localmaphostname(config)# policy-map global_policy globalhostname(config-pmap)# description This policy map defines a policy concerning connection to http server.hostname(config-pmap)# class http-serverhostname(config-pmap-c)# set connection advanced-options localmapRelated Commands
set connection timeout
To configure the timeout period, after which an idle TCP connection is disconnected, use the set connection timeout command in class mode. To remove the timeout, use the no form of this command.
set connection timeout tcp hh[:mm[:ss]] [reset]
no set connection timeout tcp
set connection timeout embryonic hh[:mm[:ss]]
no set connection timeout embryonic
set connection timeout half-closed hh[:mm[:ss]]
no set connection timeout half-closed
Syntax Description
Defaults
The default embryonic connection timeout value is 30 seconds.
The default half-closed connection timeout value is 10 minutes.
The default tcp connection timeout value is 1 hour.
Command Modes
The following table shows the modes in which you can enter the command:
Class
•
•
—
—
•
Command History
Usage Guidelines
You must have configured the policy-map command and the class command before issuing this command.
A TCP connection for which a three-way handshake is not complete is an embryonic connection. For the embryonic connection timeout value, use 0:0:0 to specify that the connection never times out. Otherwise, the timeout duration must be at least 5 seconds.
When the TCP connection is in the closing state, use the half-closed parameter to configure the length of time until the connection is freed. Use 0:0:0 to specify that the connection never times out. The minimum timeout duration is 5 minutes.
The tcp inactive connection timeout configures the period after which an idle TCP connection in the established state is disconnected. Use 0:0:0 to specify that the connection never times out. The minimum timeout duration is 5 minutes.
The reset keyword is used to send a TCP RST packet to both end systems once an idle TCP connection has timed out. Some applications require a TCP RST after a timeout to perform properly.
Examples
The following is an example of a set connection timeout command that specifies an embryonic connection timeout of two minutes:
hostname(config)# access-list http-server permit tcp any host 10.1.1.1hostname(config)# class-map http-serverhostname(config-cmap)# match access-list http-serverhostname(config-cmap)# exithostname(config)# policy-map global_policy globalhostname(config-pmap)# description This policy map defines a policy concerning connection to http server.hostname(config-pmap)# class http-serverhostname(config-pmap-c)# set connection timeout embryonic 00:2:00Related Commands
set metric
To set the metric value for a routing protocol, use the set metric command in route-map configuration mode. To return to the default metric value, use the no form of this command.
set metric value
no set metric value
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Route-map configuration
•
—
•
—
—
Command History
Usage Guidelines
The no set metric value command allows you to return to the default metric value. In this context, the value is an integer from 0 to 4294967295.
Examples
The following example shows how to configure a route map for OSPF routing:
hostname(config)# route-map maptag1 permit 8hostname(config-route-map)# set metric 5hostname(config-route-map)# match metric 5hostname(config-route-map)# show route-maproute-map maptag1 permit 8set metric 5match metric 5hostname(config-route-map)# exithostname(config)#Related Commands
set metric-type
To specify the type of OSPF metric routes, use the set metric-type command in route-map configuration mode. To return to the default setting, use the no form of this command.
set metric-type {type-1 | type-2}
no set metric-type
Syntax Description
type-1
Specifies the type of OSPF metric routes that are external to a specified autonomous system.
type-2
Specifies the type of OSPF metric routes that are external to a specified autonomous system.
Defaults
The default is type-2.
Command Modes
The following table shows the modes in which you can enter the command:
Route-map configuration
•
—
•
—
—
Command History
Examples
The following example shows how to configure a route map for OSPF routing:
hostname(config)# route-map maptag1 permit 8hostname(config-route-map)# set metric 5hostname(config-route-map)# match metric 5hostname(config-route-map)# set metric-type type-2hostname(config-route-map)# show route-maproute-map maptag1 permit 8set metric 5set metric-type type-2match metric 5hostname(config-route-map)# exithostname(config)#Related Commands
setup
To configure a minimal configuration for the security appliance using interactive prompts, enter the setup command in global configuration mode. This configuration provides connectivity to use ASDM. See also the configure factory-default command to restore the default configuration.
setup
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
The setup dialog automatically appears at boot time if there is no startup configuration in Flash memory.
Before you can use the setup command, you must have an inside interface already configured. The PIX 500 series default configuration includes an inside interface (Ethernet 1), but the ASA 550 series default configuration does not. Before using the setup command, enter the interface command for the interface you want to make inside, and then the nameif inside command.
In multiple context mode, you can use the setup command in the system execution space and for each context.
When you enter the setup command, you are asked for the information in Table 7-1. The system setup command includes a subset of these prompts. If there is already a configuration for the prompted parameter, it appears in barckets so you can either accept it as the default or override it by entering something new.
Examples
This example shows how to complete the setup command prompts:
hostname(config)# setupPre-configure Firewall now through interactive prompts [yes]? yesFirewall Mode [Routed]: routedEnable password [<use current password>]: writerAllow password recovery [yes]? yesClock (UTC):Year: 2005Month: NovDay: 15Time: 10:0:0Inside IP address: 192.168.1.1Inside network mask: 255.255.255.0Host name: tech_pubsDomain name: your_company.comIP address of host running Device Manager: 10.1.1.1The following configuration will be used:Enable password: writerAllow password recovery: yesClock (UTC): 20:54:44 Sep 17 2005Firewall Mode: RoutedInside IP address: 192.168.1.1Inside network mask: 255.255.255.0Host name: tech_pubsDomain name: your_company.comIP address of host running Device Manager: 10.1.1.1Use this configuration and write to flash? yesRelated Commands
show aaa local user
To show the list of usernames that are currently locked, or to show details about the username, use the show aaa local user command in global configuration mode.
show aaa local user [locked]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
If you omit the optional keyword locked, the security appliance displays the failed-attempts and lockout status details for all AAA local users.
You can specify a single user by using the username option or all users with the all option.
This command affects only the status of users that are locked out.
The administrator cannot be locked out of the device.
Examples
The following example shows use of the show aaa local user command to display the lockout status of all usernames:
This example shows the use of the show aaa local user command to display the number of failed authentication attempts and lockout status details for all AAA local users, after the limit has been set to 5:
hostname(config)# aaa local authentication attempts max-fail 5hostname(config)# show aaa local userLock-time Failed-attempts Locked User- 6 Y test- 2 N mona- 1 N cisco- 4 N newuserhostname(config)#This example shows the use of the show aaa local user command with the lockout keyword to display the number of failed authentication attempts and lockout status details only for any locked-out AAA local users, after the limit has been set to 5:
hostname(config)# aaa local authentication attempts max-fail 5hostname(config)# show aaa local userLock-time Failed-attempts Locked User- 6 Y testhostname(config)#Related Commands
show aaa-server
To display AAA server statistics for AAA servers, use the show aaa-server command in privileged EXEC mode:
show aaa-server [LOCAL | groupname [host hostname] | protocol protocol]
Syntax Description
Defaults
By default, all AAA server statistics display.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Examples
This example shows the use of the show aaa-server command to display statistics for a particular host in server group group1:
hostname(config)# show aaa-server group1 host 192.68.125.60Server Group: group1Server Protocol: RADIUSServer Address: 192.68.125.60Server port: 1645Server status: ACTIVE/FAILED. Last transaction (success) at 11:10:08 UTC Fri Aug 22Number of pending requests 20Average round trip time 4msNumber of authentication requests 20Number of authorization requests 0Number of accounting requests 0Number of retransmissions 1Number of accepts 16Number of rejects 4Number of challenges 5Number of malformed responses 0Number of bad authenticators 0Number of pending requests 0Number of timeouts 0Number of unrecognized responses 0hostname(config)#This example shows the use of the show aaa-server command to show the statistics for all servers in a small, inactive system:
hostname(config)# show aaa-serverServer Group: LOCALServer Protocol: Local databaseServer Address: NoneServer port: NoneServer status: ACTIVE, Last transaction at unknownNumber of pending requests 0Average round trip time 0msNumber of authentication requests 0Number of authorization requests 0Number of accounting requests 0Number of retransmissions 0Number of accepts 0Number of rejects 0Number of challenges 0Number of malformed responses 0Number of bad authenticators 0Number of timeouts 0Number of unrecognized responses 0hostname(config)#Related Commands
show running-config aaa-server
Display statistics for all servers in the indicated server group or for a particular server.
clear aaa-server statistics
Clear the AAA server statistics.
show access-list
To display the counters for an access list, use the show access-list command in privileged EXEC mode.
show access-list id
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show access-list command:
hostname# show access-list acaccess-list ac; 2 elementsaccess-list ac line 1 permit ip any any (hitcnt=0)access-list ac line 2 permit tcp any any (hitcnt=0)Related Commands
show activation-key
To display the commands in the configuration for features that are enabled by your activation key, including the number of contexts allowed, use the show activation-key command in privileged EXEC mode.
show activation-key
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
·
Command History
PIX Version 7.0
Support for this command was introduced on the security appliance.
Usage Guidelines
The show activation-key command output indicates the status of the activation key as follows:
•
The flash activation key is the SAME as the running key.•
The flash activation key is DIFFERENT from the running key.The flash activation key takes effect after the next reload.•
•
•
Examples
This example shows how to display the commands in the configuration for features that are enabled by your activation key:
hostname(config)# show activation-keySerial Number: P3000000134 Running Activation Key: 0xyadayada 0xyadayada 0xyadayada 0xyadayada 0xyadayadaLicense Features for this Platform:Maximum Physical Interfaces : UnlimitedMaximum VLANs : 50Inside Hosts : UnlimitedFailover : EnabledVPN-DES : EnabledVPN-3DES-AES : DisabledCut-through Proxy : EnabledGuards : EnabledURL-filtering : EnabledSecurity Contexts : 20GTP/GPRS : DisabledVPN Peers : 5000The flash activation key is the SAME as the running key.hostname(config)#Related Commands
show admin-context
To display the context name currently assigned as the admin context, use the show admin-context command in privileged EXEC mode.
show admin-context
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Examples
The following is sample output from the show admin-context command. The following example shows the admin context called "admin" and stored in the root directory of flash:
hostname# show admin-contextAdmin: admin flash:/admin.cfgRelated Commands
show arp
To view the ARP table, use the show arp command in privileged EXEC mode.
show arp
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The display output shows dynamic, static, and proxy ARP entries. Dynamic ARP entries include the age of the ARP entry in seconds. Static ARP entries include a dash (-) instead of the age, and proxy ARP entries state "alias."
Examples
The following is sample output from the show arp command. The first entry is a dynamic entry aged 2 seconds. The second entry is a static entry, and the third entry is from proxy ARP.
hostname# show arpoutside 10.86.194.61 0011.2094.1d2b 2outside 10.86.194.1 001a.300c.8000 -outside 10.86.195.2 00d0.02a8.440a aliasRelated Commands
show arp-inspection
To view the ARP inspection setting for each interface, use the show arp-inspection command in privileged EXEC mode.
show arp-inspection
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
—
Command History
Examples
The following is sample output from the show arp-inspection command:
hostname# show arp-inspectioninterface arp-inspection miss----------------------------------------------------inside1 enabled floodoutside disabled -The miss column shows the default action to take for non-matching packets when ARP inspection is enabled, either "flood" or "no-flood."
Related Commands
show arp statistics
To view ARP statistics, use the show arp statistics command in privileged EXEC mode.
show arp statistics
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show arp statistics command:
hostname# show arp statisticsNumber of ARP entries:ASA : 6Dropped blocks in ARP: 6Maximum Queued blocks: 3Queued blocks: 1Interface collision ARPs Received: 5ARP-defense Gratuitous ARPS sent: 4Total ARP retries: 15Unresolved hosts: 1Maximum Unresolved hosts: 2Table 2 shows each field description.
Related Commands
show asdm history
To display the contents of the ASDM history buffer, use the show asdm history command in privileged EXEC mode.
show asdm history [view timeframe] [snapshot] [feature feature] [asdmclient]
Syntax Description
Defaults
If no arguments or keywords are specified, all history information for all features is displayed.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
7.0
This command was changed from the show pdm history command to the show asdm history command.
Usage Guidelines
The show asdm history command displays the contents of the ASDM history buffer. Before you can view ASDM history information, you must enable ASDM history tracking using the asdm history enable command.
Examples
The following is sample output from the show asdm history command. It limits the output to data for the outside interface collected during the last 10 minutes.
hostname# show asdm history view 10m feature interface outsideInput KByte Count:[ 10s:12:46:41 Mar 1 2005 ] 62640 62636 62633 62628 62622 62616 62609Output KByte Count:[ 10s:12:46:41 Mar 1 2005 ] 25178 25169 25165 25161 25157 25151 25147Input KPacket Count:[ 10s:12:46:41 Mar 1 2005 ] 752 752 751 751 751 751 751Output KPacket Count:[ 10s:12:46:41 Mar 1 2005 ] 55 55 55 55 55 55 55Input Bit Rate:[ 10s:12:46:41 Mar 1 2005 ] 3397 2843 3764 4515 4932 5728 4186Output Bit Rate:[ 10s:12:46:41 Mar 1 2005 ] 7316 3292 3349 3298 5212 3349 3301Input Packet Rate:[ 10s:12:46:41 Mar 1 2005 ] 5 4 6 7 6 8 6Output Packet Rate:[ 10s:12:46:41 Mar 1 2005 ] 1 0 0 0 0 0 0Input Error Packet Count:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0No Buffer:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Received Broadcasts:[ 10s:12:46:41 Mar 1 2005 ] 375974 375954 375935 375902 375863 375833 375794Runts:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Giants:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0CRC:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Frames:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Overruns:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Underruns:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Output Error Packet Count:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Collisions:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0LCOLL:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Reset:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Deferred:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Lost Carrier:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Hardware Input Queue:[ 10s:12:46:41 Mar 1 2005 ] 128 128 128 128 128 128 128Software Input Queue:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Hardware Output Queue:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Software Output Queue:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0Drop KPacket Count:[ 10s:12:46:41 Mar 1 2005 ] 0 0 0 0 0 0 0hostname#The following is sample output from the show asdm history command. Like the previous example, it limits the output to data for the outside interface collected during the last 10 minutes. However, in this example the output is formatted for the ASDM client.
hostname# show asdm history view 10m feature interface outside asdmclientMH|IBC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|62439|62445|62453|62457|62464|6 2469|62474|62486|62489|62496|62501|62506|62511|62518|62522|62530|62534|62539|62542|62547|6 2553|62556|62562|62568|62574|62581|62585|62593|62598|62604|62609|62616|62622|62628|62633|6 2636|62640|62653|62657|62665|62672|62678|62681|62686|62691|62695|62700|62704|62711|62718|6 2723|62728|62733|62738|62742|62747|62751|62761|62770|62775|MH|OBC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|25023|25023|25025|25025|25025|2 5026|25026|25032|25038|25044|25052|25056|25060|25064|25070|25076|25083|25087|25091|25096|2 5102|25106|25110|25114|25118|25122|25128|25133|25137|25143|25147|25151|25157|25161|25165|2 5169|25178|25321|25327|25332|25336|25341|25345|25349|25355|25359|25363|25367|25371|25375|2 5381|25386|25390|25395|25399|25403|25410|25414|25418|25422|MH|IPC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|749|749|749|749|749|750|750|750 |750|750|750|750|750|750|750|750|750|750|750|750|751|751|751|751|751|751|751|751|751|751|7 51|751|751|751|751|752|752|752|752|752|752|752|752|752|752|752|752|752|752|753|753|753|753 |753|753|753|753|753|753|753|MH|OPC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|55|55|55|55|55|55|55|55|55|55|5 5|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|55|5 5|55|55|56|56|56|56|56|56|56|56|56|56|56|56|56|56|56|56|56|MH|IBR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|7127|5155|6202|3545|5408|3979|4 381|9492|3033|4962|4571|4226|3760|5923|3265|6494|3441|3542|3162|4076|4744|2726|4847|4292|5 401|5166|3735|6659|3837|5260|4186|5728|4932|4515|3764|2843|3397|10768|3080|6309|5969|4472| 2780|4492|3540|3664|3800|3002|6258|5567|4044|4059|4548|3713|3265|4159|3630|8235|6934|4298|MH|OBR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|82791|57|1410|588|57|639|0|4698 |5068|4992|6495|3292|3292|3352|5061|4808|5205|3931|3298|3349|5064|3439|3356|3292|3343|3349 |5067|3883|3356|4500|3301|3349|5212|3298|3349|3292|7316|116896|5072|3881|3356|3931|3298|33 49|5064|3292|3349|3292|3292|3349|5061|3883|3356|3931|3452|3356|5064|3292|3349|3292|MH|IPR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|12|8|6|5|7|5|6|14|5|7|7|5|6|9|5 |8|6|5|5|7|6|5|6|5|6|7|6|8|6|6|6|8|6|7|6|4|5|19|5|8|7|6|4|7|5|6|6|5|7|8|6|6|7|5|5|7|6|9|7| 6|MH|OPR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|12|0|1|0|0|0|0|4|0|2|2|0|0|0|0| 1|1|0|0|0|0|0|0|0|0|0|0|0|0|1|0|0|0|0|0|0|1|28|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |MH|IERR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|NB|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|RB|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|374874|374911|374943|374967|3750 10|375038|375073|375113|375140|375160|375181|375211|375243|375289|375316|375350|375373|375 395|375422|375446|375481|375498|375535|375561|375591|375622|375654|375701|375738|375761|37 5794|375833|375863|375902|375935|375954|375974|375999|376027|376075|376115|376147|376168|3 76200|376224|376253|376289|376315|376365|376400|376436|376463|376508|376530|376553|376583| 376614|376668|376714|376749|MH|RNT|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|GNT|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|CRC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|FRM|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|OR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|UR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|OERR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|COLL|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0| 0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|LCOLL|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |MH|RST|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|DEF|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|LCR|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|HIQ|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|128|128|128|128|128|128|128|128 |128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|1 28|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128|128 |128|128|128|128|128|128|128|MH|SIQ|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|HOQ|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|SOQ|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|MH|DPC|10|CURFACT|0|CURVAL|0|TIME|1109703031|MAX|60|NUM|60|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0 |0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|hostname#The following is sample output from the show asdm history command using the snapshot keyword:
hostname# show asdm history view 10m snapshotAvailable 4 byte Blocks: [ 10s] : 100Used 4 byte Blocks: [ 10s] : 0Available 80 byte Blocks: [ 10s] : 100Used 80 byte Blocks: [ 10s] : 0Available 256 byte Blocks: [ 10s] : 2100Used 256 byte Blocks: [ 10s] : 0Available 1550 byte Blocks: [ 10s] : 7425Used 1550 byte Blocks: [ 10s] : 1279Available 2560 byte Blocks: [ 10s] : 40Used 2560 byte Blocks: [ 10s] : 0Available 4096 byte Blocks: [ 10s] : 30Used 4096 byte Blocks: [ 10s] : 0Available 8192 byte Blocks: [ 10s] : 60Used 8192 byte Blocks: [ 10s] : 0Available 16384 byte Blocks: [ 10s] : 100Used 16384 byte Blocks: [ 10s] : 0Available 65536 byte Blocks: [ 10s] : 10Used 65536 byte Blocks: [ 10s] : 0CPU Utilization: [ 10s] : 31Input KByte Count: [ 10s] : 62930Output KByte Count: [ 10s] : 26620Input KPacket Count: [ 10s] : 755Output KPacket Count: [ 10s] : 58Input Bit Rate: [ 10s] : 24561Output Bit Rate: [ 10s] : 518897Input Packet Rate: [ 10s] : 48Output Packet Rate: [ 10s] : 114Input Error Packet Count: [ 10s] : 0No Buffer: [ 10s] : 0Received Broadcasts: [ 10s] : 377331Runts: [ 10s] : 0Giants: [ 10s] : 0CRC: [ 10s] : 0Frames: [ 10s] : 0Overruns: [ 10s] : 0Underruns: [ 10s] : 0Output Error Packet Count: [ 10s] : 0Collisions: [ 10s] : 0LCOLL: [ 10s] : 0Reset: [ 10s] : 0Deferred: [ 10s] : 0Lost Carrier: [ 10s] : 0Hardware Input Queue: [ 10s] : 128Software Input Queue: [ 10s] : 0Hardware Output Queue: [ 10s] : 0Software Output Queue: [ 10s] : 0Drop KPacket Count: [ 10s] : 0Input KByte Count: [ 10s] : 3672Output KByte Count: [ 10s] : 4051Input KPacket Count: [ 10s] : 19Output KPacket Count: [ 10s] : 20Input Bit Rate: [ 10s] : 0Output Bit Rate: [ 10s] : 0Input Packet Rate: [ 10s] : 0Output Packet Rate: [ 10s] : 0Input Error Packet Count: [ 10s] : 0No Buffer: [ 10s] : 0Received Broadcasts: [ 10s] : 1458Runts: [ 10s] : 1Giants: [ 10s] : 0CRC: [ 10s] : 0Frames: [ 10s] : 0Overruns: [ 10s] : 0Underruns: [ 10s] : 0Output Error Packet Count: [ 10s] : 0Collisions: [ 10s] : 63LCOLL: [ 10s] : 0Reset: [ 10s] : 0Deferred: [ 10s] : 15Lost Carrier: [ 10s] : 0Hardware Input Queue: [ 10s] : 128Software Input Queue: [ 10s] : 0Hardware Output Queue: [ 10s] : 0Software Output Queue: [ 10s] : 0Drop KPacket Count: [ 10s] : 0Input KByte Count: [ 10s] : 0Output KByte Count: [ 10s] : 0Input KPacket Count: [ 10s] : 0Output KPacket Count: [ 10s] : 0Input Bit Rate: [ 10s] : 0Output Bit Rate: [ 10s] : 0Input Packet Rate: [ 10s] : 0Output Packet Rate: [ 10s] : 0Input Error Packet Count: [ 10s] : 0No Buffer: [ 10s] : 0Received Broadcasts: [ 10s] : 0Runts: [ 10s] : 0Giants: [ 10s] : 0CRC: [ 10s] : 0Frames: [ 10s] : 0Overruns: [ 10s] : 0Underruns: [ 10s] : 0Output Error Packet Count: [ 10s] : 0Collisions: [ 10s] : 0LCOLL: [ 10s] : 0Reset: [ 10s] : 0Deferred: [ 10s] : 0Lost Carrier: [ 10s] : 0Hardware Input Queue: [ 10s] : 128Software Input Queue: [ 10s] : 0Hardware Output Queue: [ 10s] : 0Software Output Queue: [ 10s] : 0Drop KPacket Count: [ 10s] : 0Input KByte Count: [ 10s] : 0Output KByte Count: [ 10s] : 0Input KPacket Count: [ 10s] : 0Output KPacket Count: [ 10s] : 0Input Bit Rate: [ 10s] : 0Output Bit Rate: [ 10s] : 0Input Packet Rate: [ 10s] : 0Output Packet Rate: [ 10s] : 0Input Error Packet Count: [ 10s] : 0No Buffer: [ 10s] : 0Received Broadcasts: [ 10s] : 0Runts: [ 10s] : 0Giants: [ 10s] : 0CRC: [ 10s] : 0Frames: [ 10s] : 0Overruns: [ 10s] : 0Underruns: [ 10s] : 0Output Error Packet Count: [ 10s] : 0Collisions: [ 10s] : 0LCOLL: [ 10s] : 0Reset: [ 10s] : 0Deferred: [ 10s] : 0Lost Carrier: [ 10s] : 0Hardware Input Queue: [ 10s] : 128Software Input Queue: [ 10s] : 0Hardware Output Queue: [ 10s] : 0Software Output Queue: [ 10s] : 0Drop KPacket Count: [ 10s] : 0Available Memory: [ 10s] : 205149944Used Memory: [ 10s] : 63285512Xlate Count: [ 10s] : 0Connection Count: [ 10s] : 0TCP Connection Count: [ 10s] : 0UDP Connection Count: [ 10s] : 0URL Filtering Count: [ 10s] : 0URL Server Filtering Count: [ 10s] : 0TCP Fixup Count: [ 10s] : 0TCP Intercept Count: [ 10s] : 0HTTP Fixup Count: [ 10s] : 0FTP Fixup Count: [ 10s] : 0AAA Authentication Count: [ 10s] : 0AAA Authorzation Count: [ 10s] : 0AAA Accounting Count: [ 10s] : 0Current Xlates: [ 10s] : 0Max Xlates: [ 10s] : 0ISAKMP SAs: [ 10s] : 0IPSec SAs: [ 10s] : 0L2TP Sessions: [ 10s] : 0L2TP Tunnels: [ 10s] : 0hostname#Related Commands
show asdm image
To the current ASDM software image file, use the show asdm image command in privileged EXEC mode.
show asdm image
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
7.0
This command was changed from the show pdm image command to the show asdm image command.
Examples
The following is sample output from the show asdm image command:
hostname# show asdm imageDevice Manager image file, flash:/ASDMRelated Commands
show asdm log_sessions
To display a list of active ASDM logging sessions and their associated session IDs, use the show asdm log_sessions command in privileged EXEC mode.
show asdm log_sessions
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Each active ASDM session has one or more associated ASDM logging sessions. ASDM uses the logging session to retrieve syslog messages from the security appliance. Each ASDM logging session is assigned a unique session ID. You can use this session ID with the asdm disconnect log_session command to terminate the specified session.
Note
Examples
The following is sample output from the show asdm log_sessions command:
hostname# show asdm log_sessions0 192.168.1.11 192.168.1.2Related Commands
show asdm sessions
To display a list of active ASDM sessions and their associated session IDs, use the show asdm sessions command in privileged EXEC mode.
show asdm sessions
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
7.0
This command was changed from the show pdm sessions command to the show asdm sessions command.
Usage Guidelines
Each active ASDM session is assigned a unique session ID. You can use this session ID with the asdm disconnect command to terminate the specified session.
Examples
The following is sample output from the show asdm sessions command:
hostname# show asdm sessions0 192.168.1.11 192.168.1.2Related Commands
show asp drop
To debug the accelerated security path dropped packets or connections, use the show asp drop command in privileged EXEC mode.
show asp drop [flow [flow_drop_reason] | frame [frame_drop_reason]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp drop command shows the packets or connections dropped by the accelerated security path, which might help you troubleshoot a problem. See the Cisco Security Appliance Command Line Configuration Guide for more information about the accelerated security path. This information is used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Table 7-3 lists valid values for the flow_drop_reason argument for dropped flows. Table 7-4 lists valid values for the frame_drop_reason argument for dropped frames.
Table 7-4 lists valid values for the frame_drop_reason argument for dropped frames.
Examples
The following is sample output from the show asp drop command, with the timestamp indicating when the last time the counters were cleared:
hostname# show asp dropFrame drop:Flow is denied by configured rule (acl-drop) 3Dst MAC L2 Lookup Failed (dst-l2_lookup-fail) 4110L2 Src/Dst same LAN port (l2_same-lan-port) 760Expired flow (flow-expired) 1Last clearing: NeverFlow drop:Flow is denied by access rule (acl-drop) 24NAT failed (nat-failed) 28739NAT reverse path failed (nat-rpf-failed) 22266Inspection failure (inspect-fail) 19433Last clearing: 17:02:12 UTC Jan 17 2008 by enable_15Related Commands
clear asp drop
Clears drop statistics for the accelerated security path.
show conn
Shows information about connections.
show asp table arp
To debug the accelerated security path ARP tables, use the show asp table arp command in privileged EXEC mode.
show asp table arp [interface interface_name] [address ip_address [netmask mask]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show arp command shows the contents of the control plane, while the show asp table arp command shows the contents of the accelerated security path, which might help you troubleshoot a problem. See the Cisco Security Appliance Command Line Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table arp command:
hostname# show asp table arpContext: single_vf, Interface: inside10.86.194.50 Active 000f.66ce.5d46 hits 010.86.194.1 Active 00b0.64ea.91a2 hits 63810.86.194.172 Active 0001.03cf.9e79 hits 010.86.194.204 Active 000f.66ce.5d3c hits 010.86.194.188 Active 000f.904b.80d7 hits 0Context: single_vf, Interface: identity:: Active 0000.0000.0000 hits 00.0.0.0 Active 0000.0000.0000 hits 50208Related Commands
show asp table classify
To debug the accelerated security path classifier tables, use the show asp table classify command in privileged EXEC mode. The classifier examines properties of incoming packets, such as protocol, and source and destination address, to match each packet to an appropriate classification rule. Each rule is labeled with a classification domain that determines what types of actions are performed, such as dropping a packet or allowing it through.
show asp table classify [hit | crypto | domain domain_name | interface interface_name]
Syntax Description
crypto
(Optional) Shows the encrypt, decrypt, and ipsec tunnel flow domains only.
domain domain_name
(Optional) Shows entries for a specific classifier domain. See "Usage Guidelines" for a list of domains.
hits
(Optional) Shows classifier entries which have non-zero hits values
interface interface_name
(Optional) Identifies a specific interface for which you want to view the classifier table.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
7.0
This command was introduced.
7.2(4)
Added the hits option, and the timestamp indicating when the last time the asp table counters were cleared.
Usage Guidelines
The show asp table classifier command shows the classifier contents of the accelerated security path, which might help you troubleshoot a problem. See the Cisco Security Appliance Command Line Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Classifier domains include the following:
aaa-acctaaa-authaaa-useraccountingarpcapturecaptureconn-nailedconn-setctcpdecryptencryptestablishedfilter-activexfilter-ftpfilter-httpsfilter-javafilter-urlhostidsinspectinspect-ctiqbeinspect-dnsinspect-dns-idsinspect-ftpinspect-ftp-datainspect-gtpinspect-h323inspect-httpinspect-icmpinspect-icmp-errorinspect-ilsinspect-mgcpinspect-netbiosinspect-pptpinspect-rshinspect-rtspinspect-sipinspect-skinnyinspect-smtpinspect-snmpinspect-sqlnetinspect-sqlnet-plusinspect-sunrpcinspect-tftpinspect-xdmcpipsec-nattipsec-tunnel-flowipsec-userlimitslumac-permitmgmt-lockdownmgmt-tcp-interceptmulticastnatnat-exemptnat-exempt-reversenat-reversenullpermitpermit-ip-optionpermit-logpimppppriority-qpuntpunt-l2punt-rootqosqos-per-classqos-per-destqos-per-flowqos-per-sourceshuntcp-interceptExamples
The following is sample output from the show asp table classify command:
hostname# show asp table classifyInterface test:in id=0x36f3800, priority=10, domain=punt, deny=falsehits=0, user_data=0x0, flags=0x0src ip=0.0.0.0, mask=0.0.0.0, port=0dst ip=10.86.194.60, mask=255.255.255.255, port=0in id=0x33d3508, priority=99, domain=inspect, deny=falsehits=0, user_data=0x0, use_real_addr, flags=0x0src ip=0.0.0.0, mask=0.0.0.0, port=0dst ip=0.0.0.0, mask=0.0.0.0, port=0in id=0x33d3978, priority=99, domain=inspect, deny=falsehits=0, user_data=0x0, use_real_addr, flags=0x0src ip=0.0.0.0, mask=0.0.0.0, port=53dst ip=0.0.0.0, mask=0.0.0.0, port=0...The following is sample output from the show asp table classify hits command with a record of the last clearing hits counters:
Interface mgmt:in id=0x494cd88, priority=210, domain=permit, deny=truehits=54, user_data=0x1, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip=0.0.0.0, mask=0.0.0.0, port=0 dst ip=255.255.255.255, mask=255.255.255.255, port=0, dscp=0x0in id=0x494d1b8, priority=112, domain=permit, deny=falsehits=1, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=1 src ip=0.0.0.0, mask=0.0.0.0, port=0 dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0Interface inside:in id=0x48f1580, priority=210, domain=permit, deny=truehits=54, user_data=0x1, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip=0.0.0.0, mask=0.0.0.0, port=0 dst ip=255.255.255.255, mask=255.255.255.255, port=0, dscp=0x0in id=0x48f09e0, priority=1, domain=permit, deny=falsehits=101, user_data=0x0, cs_id=0x0, l3_type=0x608 src mac=0000.0000.0000, mask=0000.0000.0000 dst mac=0000.0000.0000, mask=0000.0000.0000Interface outside:in id=0x48c0970, priority=210, domain=permit, deny=truehits=54, user_data=0x1, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip=0.0.0.0, mask=0.0.0.0, port=0 dst ip=255.255.255.255, mask=255.255.255.255, port=0, dscp=0x0Related Commands
show asp table interfaces
To debug the accelerated security path interface tables, use the show asp table interfaces command in privileged EXEC mode.
show asp table interfaces
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table interfaces command shows the interface table contents of the accelerated security path, which might help you troubleshoot a problem. See the Cisco Security Appliance Command Line Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table interfaces command:
hostname# show asp table interfaces** Flags: 0x0001-DHCP, 0x0002-VMAC, 0x0010-Ident Ifc, 0x0020-HDB Initd,0x0040-RPF EnabledSoft-np interface 'dmz' is upcontext single_vf, nicnum 0, mtu 1500vlan 300, Not shared, seclvl 500 packets input, 1 packets outputflags 0x20Soft-np interface 'foo' is downcontext single_vf, nicnum 2, mtu 1500vlan <None>, Not shared, seclvl 00 packets input, 0 packets outputflags 0x20Soft-np interface 'outside' is downcontext single_vf, nicnum 1, mtu 1500vlan <None>, Not shared, seclvl 500 packets input, 0 packets outputflags 0x20Soft-np interface 'inside' is upcontext single_vf, nicnum 0, mtu 1500vlan <None>, Not shared, seclvl 100680277 packets input, 92501 packets outputflags 0x20...Related Commands
interface
Configures an interface and enters interface configuration mode.
show interface
Displays the runtime status and statistics of interfaces.
show asp table routing
To debug the accelerated security path routing tables, use the show asp table routing command in privileged EXEC mode. This command supports IPv4 and IPv6 addresses.
show asp table routing [input | output] [address ip_address [netmask mask] | interface interface_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table routing command shows the routing table contents of the accelerated security path, which might help you troubleshoot a problem. See the Cisco Security Appliance Command Line Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table routing command:
hostname# show asp table routingin 255.255.255.255 255.255.255.255 identityin 224.0.0.9 255.255.255.255 identityin 10.86.194.60 255.255.255.255 identityin 10.86.195.255 255.255.255.255 identityin 10.86.194.0 255.255.255.255 identityin 209.165.202.159 255.255.255.255 identityin 209.165.202.255 255.255.255.255 identityin 209.165.201.30 255.255.255.255 identityin 209.165.201.0 255.255.255.255 identityin 10.86.194.0 255.255.254.0 insidein 224.0.0.0 240.0.0.0 identityin 0.0.0.0 0.0.0.0 insideout 255.255.255.255 255.255.255.255 fooout 224.0.0.0 240.0.0.0 fooout 255.255.255.255 255.255.255.255 testout 224.0.0.0 240.0.0.0 testout 255.255.255.255 255.255.255.255 insideout 10.86.194.0 255.255.254.0 insideout 224.0.0.0 240.0.0.0 insideout 0.0.0.0 0.0.0.0 via 10.86.194.1, insideout 0.0.0.0 0.0.0.0 via 0.0.0.0, identityout :: :: via 0.0.0.0, identityRelated Commands
show asp table vpn-context
To debug the accelerated security path VPN context tables, use the show asp table vpn-context command in privileged EXEC mode.
show asp table vpn-context [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show asp table vpn-context command shows the VPN context contents of the accelerated security path, which might help you troubleshoot a problem. See the Cisco Security Appliance Command Line Configuration Guide for more information about the accelerated security path. These tables are used for debugging purposes only, and the information output is subject to change. Consult Cisco TAC to help you debug your system with this command.
Examples
The following is sample output from the show asp table vpn-context command:
hostname# show asp table vpn-contextVPN ID=0058070576, DECR+ESP, UP, pk=0000000000, rk=0000000000, gc=0VPN ID=0058193920, ENCR+ESP, UP, pk=0000000000, rk=0000000000, gc=0VPN ID=0058168568, DECR+ESP, UP, pk=0000299627, rk=0000000061, gc=2VPN ID=0058161168, ENCR+ESP, UP, pk=0000305043, rk=0000000061, gc=1VPN ID=0058153728, DECR+ESP, UP, pk=0000271432, rk=0000000061, gc=2VPN ID=0058150440, ENCR+ESP, UP, pk=0000285328, rk=0000000061, gc=1VPN ID=0058102088, DECR+ESP, UP, pk=0000268550, rk=0000000061, gc=2VPN ID=0058134088, ENCR+ESP, UP, pk=0000274673, rk=0000000061, gc=1VPN ID=0058103216, DECR+ESP, UP, pk=0000252854, rk=0000000061, gc=2...The following is sample output from the show asp table vpn-context detail command:
hostname# show asp table vpn-context detailVPN Ctx = 0058070576 [0x03761630]State = UPFlags = DECR+ESPSA = 0x037928F0SPI = 0xEA0F21F0Group = 0Pkts = 0Bad Pkts = 0Bad SPI = 0Spoof = 0Bad Crypto = 0Rekey Pkt = 0Rekey Call = 0VPN Ctx = 0058193920 [0x0377F800]State = UPFlags = ENCR+ESPSA = 0x037B4B70SPI = 0x900FDC32Group = 0Pkts = 0Bad Pkts = 0Bad SPI = 0Spoof = 0Bad Crypto = 0Rekey Pkt = 0Rekey Call = 0...Related Commands
show blocks
To show the packet buffer utilization, use the show blocks command in privileged EXEC mode.
show blocks [{address hex | all | assigned | free | old | pool size [summary]} [diagnostics | dump | header | packet] | queue history [detail]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show blocks command helps you determine if the security appliance is overloaded. This command lists preallocated system buffer utilization. A full memory condition is not a problem as long as traffic is moving through the security appliance. You can use the show conn command to see if traffic is moving. If traffic is not moving and the memory is full, there may be a problem.
You can also view this information using SNMP.
The information shown in a security context includes the system-wide information as well as context-specific information about the blocks in use and the high water mark for block usage.
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show blocks command in single mode:
hostname# show blocksSIZE MAX LOW CNT4 1600 1598 159980 400 398 399256 3600 3540 35421550 4716 3177 318416384 10 10 102048 1000 1000 1000Table 7-5 shows each field description.
The following is sample output from the show blocks all command:
hostname# show blocks allClass 0, size 4Block allocd_by freed_by data size alloccnt dup_cnt oper location0x01799940 0x00000000 0x00101603 0 0 0 alloc not_specified0x01798e80 0x00000000 0x00101603 0 0 0 alloc not_specified0x017983c0 0x00000000 0x00101603 0 0 0 alloc not_specified...Found 1000 of 1000 blocksDisplaying 1000 of 1000 blocksTable 7-6 shows each field description.
The following is sample output from the show blocks command in a context:
hostname/contexta# show blocksSIZE MAX LOW CNT INUSE HIGH4 1600 1599 1599 0 080 400 400 400 0 0256 3600 3538 3540 0 11550 4616 3077 3085 0 0The following is sample output from the show blocks queue history command:
hostname# show blocks queue historyEach Summary for User and Queue_type is followed its top 5 individual queuesBlock Size: 4Summary for User "http", Queue "tcp_unp_c_in", Blocks 1595, Queues 1396Blk_cnt Q_cnt Last_Op Queue_Type User Context186 1 put contexta15 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextcSummary for User "aaa", Queue "tcp_unp_c_in", Blocks 220, Queues 200Blk_cnt Q_cnt Last_Op Queue_Type User Context21 1 put contexta1 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextcBlk_cnt Q_cnt Last_Op Queue_Type User Context200 1 alloc ip_rx tcp contexta108 1 get ip_rx udp contexta85 1 free fixup h323_ras contextb42 1 put fixup skinny contextbBlock Size: 1550Summary for User "http", Queue "tcp_unp_c_in", Blocks 1595, Queues 1000Blk_cnt Q_cnt Last_Op Queue_Type User Context186 1 put contexta15 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextc...The following is sample output from the show blocks queue history detail command:
hostname# show blocks queue history detailHistory buffer memory usage: 2136 bytes (default)Each Summary for User and Queue type is followed its top 5 individual queuesBlock Size: 4Summary for User "http", Queue_Type "tcp_unp_c_in", Blocks 1595, Queues 1396Blk_cnt Q_cnt Last_Op Queue_Type User Context186 1 put contexta15 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextcFirst Block information for Block at 0x.....dup_count 0, flags 0x8000000, alloc_pc 0x43ea2a,start_addr 0xefb1074, read_addr 0xefb118c, write_addr 0xefb1193urgent_addr 0xefb118c, end_addr 0xefb17b20efb1150: 00 00 00 03 47 c5 61 c5 00 05 9a 38 76 80 a3 00 | ....G.a....8v...0efb1160: 00 0a 08 00 45 00 05 dc 9b c9 00 00 ff 06 f8 f3 | ....E...........0efb1170: 0a 07 0d 01 0a 07 00 50 00 17 cb 3d c7 e5 60 62 | .......P...=..`b0efb1180: 7e 73 55 82 50 18 10 00 45 ca 00 00 2d 2d 20 49 | ~sU.P...E...-- I0efb1190: 50 20 2d 2d 0d 0a 31 30 2e 37 2e 31 33 2e 31 09 | P --..10.7.13.1.0efb11a0: 3d 3d 3e 09 31 30 2e 37 2e 30 2e 38 30 0d 0a 0d | ==>.10.7.0.80...Summary for User "aaa", Queue "tcp_unp_c_in", Blocks 220, Queues 200Blk_cnt Q_cnt Last_Op Queue_Type User Context21 1 put contexta1 1 put contexta1 1 put contexta1 1 put contextb1 1 put contextcFirst Block information for Block at 0x.....dup_count 0, flags 0x8000000, alloc_pc 0x43ea2a,start_addr 0xefb1074, read_addr 0xefb118c, write_addr 0xefb1193urgent_addr 0xefb118c, end_addr 0xefb17b20efb1150: 00 00 00 03 47 c5 61 c5 00 05 9a 38 76 80 a3 00 | ....G.a....8v...0efb1160: 00 0a 08 00 45 00 05 dc 9b c9 00 00 ff 06 f8 f3 | ....E...........0efb1170: 0a 07 0d 01 0a 07 00 50 00 17 cb 3d c7 e5 60 62 | .......P...=..`b0efb1180: 7e 73 55 82 50 18 10 00 45 ca 00 00 2d 2d 20 49 | ~sU.P...E...-- I0efb1190: 50 20 2d 2d 0d 0a 31 30 2e 37 2e 31 33 2e 31 09 | P --..10.7.13.1.0efb11a0: 3d 3d 3e 09 31 30 2e 37 2e 30 2e 38 30 0d 0a 0d | ==>.10.7.0.80......total_count: total buffers in this classThe following is sample output from the show blocks pool summary command:
hostname# show blocks pool 1550 summaryClass 3, size 1550=================================================total_count=1531 miss_count=0Alloc_pc valid_cnt invalid_cnt0x3b0a18 00000256 000000000x01ad0760 0x01acfe00 0x01acf4a0 0x01aceb40 00000000 0x000000000x3a8f6b 00001275 000000120x05006aa0 0x05006140 0x050057e0 0x05004520 000000000x00000000=================================================total_count=9716 miss_count=0Freed_pc valid_cnt invalid_cnt0x9a81f3 00000104 000000070x05006140 0x05000380 0x04fffa20 0x04ffde00 00000000 0x000000000x9a0326 00000053 000000330x05006aa0 0x050057e0 0x05004e80 0x05003260 00000000 0x000000000x4605a2 00000005 000000000x04ff5ac0 0x01e8e2e0 0x01e2eac0 0x01e17d20 00000000 0x00000000...=================================================total_count=1531 miss_count=0Queue valid_cnt invalid_cnt0x3b0a18 00000256 00000000 Invalid Bad qtype0x01ad0760 0x01acfe00 0x01acf4a0 0x01aceb40 00000000 0x000000000x3a8f6b 00001275 00000000 Invalid Bad qtype0x05006aa0 0x05006140 0x050057e0 0x05004520 000000000x00000000=================================================free_cnt=8185 fails=0 actual_free=8185 hash_miss=003a8d3e0 03a8b7c0 03a7fc40 03a6ff20 03a6f5c0 03a6ec60 kao-f1#Table 7-7 shows each field description.
Related Commands
blocks
Increases the memory assigned to block diagnostics
clear blocks
Clears the system buffer statistics.
show conn
Shows active connections.
show bootvar
To show the boot file and configuration properties, use the show boot command in privileged configuration mode.
show bootvar
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged Mode
·
·
·
·
·
Command History
Usage Guidelines
The BOOT variable specifies a list of bootable images on various devices. The CONFIG_FILE variable specifies the configuration file used during system initialization. Set these variables with the boot system command, and boot config command, respectively.
Examples
The following example, the BOOT variable contains disk0:/f1_image, which is the image booted when the system reloads. The current value of BOOT is disk0:/f1_image; disk0:/f1_backupimage. This meansboot variable has been modified with the boot system command, but the running configuration has notbeen saved with the write memory command. When the running config is saved, the BOOT variable and current BOOT variable will both be disk0:/f1_image; disk0:/f1_backupimage. Assuming the running configuration is saved the boot loader will attempt to load the contents of the BOOT variable, starting with disk0:/f1image, but if that is not present or invalid, it will attempt to boot disk0:1/f1_backupimage.
The CONFIG_FILE variable points to the system startup configuration. In this example it is not set, so the startup configuration file is the default specified with the boot config command. The current CONFIG_FILE variable may be modified with the boot config command and saved with the write memory command.
hostname# show bootvarBOOT variable = disk0:/f1_imageCurrent BOOT variable = disk0:/f1_image; disk0:/f1_backupimageCONFIG_FILE variable =Current CONFIG_FILE variable =hostname#Related Commands
show capture
To display the capture configuration when no options are specified, use the show capture command.
show capture [capture_name] [access-list access_list_name] [count number] [decode] [detail] [dump] [packet-number number]
Syntax Description
Defaults
This command has no default settings.
Command Modes
Security Context Mode: single context mode and multiple context mode
Access Location: system and context command line
Command Mode: privileged mode
Firewall Mode: routed firewall mode and transparent firewall mode
Command History
PIX Version 7.0
Support for this command was introduced on the security appliance.
Usage Guidelines
If you specify the capture_name, then the capture buffer contents for that capture are displayed.
The dump keyword does not display MAC information in the hexadecimal dump.
The decoded output of the packets depend on the protocol of the packet. In Table 7-8, the bracketed output is displayed when you specify the detail keyword.
Examples
This example shows how to display the capture configuration:
hostname(config)# show capturecapture arp ethernet-type arp interface outsidecapture http access-list http packet-length 74 interface insideThis example shows how to display the packets that are captured by an ARP capture:
hostname(config)# show capture arp2 packets captured19:12:23.478429 arp who-has 171.69.38.89 tell 171.69.38.1019:12:26.784294 arp who-has 171.69.38.89 tell 171.69.38.102 packets shownRelated Commands
show chardrop
To display the count of characters dropped from the serial console, use the show chardrop command in privileged EXEC mode.
show chardrop
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following is sample output from the show chardrop command:
hostname# show chardropChars dropped pre-TxTimeouts: 0, post-TxTimeouts: 0
Related Commands
show checkheaps
To show the checkheaps statistics, use the show checkheaps command in privileged EXEC mode. Checkheaps is a periodic process that verifies the sanity of the heap memory buffers (dynamic memory is allocated from the system heap memory region) and the integrity of the code region.
show checkheaps
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
The following is sample output from the show checkheaps command:
hostname# show checkheapsCheckheaps stats from buffer validation runs--------------------------------------------Time elapsed since last run : 42 secsDuration of last run : 0 millisecsNumber of buffers created : 8082Number of buffers allocated : 7808Number of buffers free : 274Total memory in use : 43570344 bytesTotal memory in free buffers : 87000 bytesTotal number of runs : 310Related Commands
show checksum
To display the configuration checksum, use the show checksum command in privileged EXEC mode.
show checksum
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
Command History
Usage Guidelines
The show checksum command allows you to display four groups of hexadecimal numbers that act as a digital summary of the configuration contents. This checksum is calculated only when you store the configuration in Flash memory.
If a dot (".") appears before the checksum in the show config or show checksum command output, the output indicates a normal configuration load or write mode indicator (when loading from or writing to the security appliance Flash partition). The "." shows that the security appliance is preoccupied with the operation but is not "hung up." This message is similar to a "system processing, please wait" message.
Examples
This example shows how to display the configuration or the checksum:
hostname(config)# show checksumCryptochecksum: 1a2833c0 129ac70b 1a88df85 650dbb81
show chunkstat
To display the chunk statistics, use the show chunkstat command in privileged EXEC mode.
show chunkstat
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
This example shows how to display the chunk statistics:
hostname# show chunkstatGlobal chunk statistics: created 181, destroyed 34, siblings created 94, siblings destroyed 34Per-chunk statistics: siblings created 0, siblings trimmed 0Dump of chunk at 01edb4cc, name "Managed Chunk Queue Elements", data start @ 01edbd24, end @ 01eddc54next: 01eddc8c, next_sibling: 00000000, prev_sibling: 00000000flags 00000001maximum chunk elt's: 499, elt size: 16, index first free 498# chunks in use: 1, HWM of total used: 1, alignment: 0Per-chunk statistics: siblings created 0, siblings trimmed 0Dump of chunk at 01eddc8c, name "Registry Function List", data start @ 01eddea4, end @ 01ede348next: 01ede37c, next_sibling: 00000000, prev_sibling: 00000000flags 00000001maximum chunk elt's: 99, elt size: 12, index first free 42# chunks in use: 57, HWM of total used: 57, alignment: 0Related Commands
show counters
Displays the protocol stack counters.
show cpu
Displays the CPU utilization information.
show clock
To view the time on the security appliance, use the show clock command in user EXEC mode.
show clock [detail]
Syntax Description
detail
(Optional) Indicates the clock source (NTP or user configuration) and the current summer-time setting (if any).
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
•
•
Command History
Examples
The following is sample output from the show clock command:
hostname> show clock12:35:45.205 EDT Tue Jul 27 2004The following is sample output from the show clock detail command:
hostname> show clock detail12:35:45.205 EDT Tue Jul 27 2004Time source is user configurationSummer time starts 02:00:00 EST Sun Apr 4 2004Summer time ends 02:00:00 EDT Sun Oct 31 2004Related Commands
show conn
To display the connection state for the designated connection type, use the show conn command in privileged EXEC mode. This command supports IPv4 and IPv6 addresses.
show conn [count | [all] [detail] [long] [state state_type] [protocol {tcp | udp}] [address src_ip[-src_ip] [netmask mask]] [port src_port[-src_port]] [address dest_ip[-dest_ip] [netmask mask]] [port dest_port[-dest_port]]]
Syntax Description
address
(Optional) Displays connections with the specified source or destination IP address.
all
(Optional) Displays connections that are to the device or from the device, in addition to through-traffic connections.
count
(Optional) Displays the number of active connections.
dest_ip
(Optional) Specifies the destination IP address (IPv4 or IPv6). To specify a range, separate the IP addresses with a dash (-), For example:
10.1.1.1-10.1.1.5dest_port
(Optional) Specifies the destination port number. To specify a range, separate the port numbers with a dash (-), For example:
1000-2000detail
(Optional) Displays connections in detail, including translation type and interface information.
long
(Optional) Displays connections in long format.
netmask mask
(Optional) Specifies a subnet mask for use with the given IP address.
port
(Optional) Displays connections with the specified source or destination port.
protocol {tcp | udp}
(Optional) Specifies the connection protocol, tcp or udp.
src_ip
(Optional) Specifies the source IP address (IPv4 or IPv6). To specify a range, separate the IP addresses with a dash (-), For example:
10.1.1.1-10.1.1.5src_port
(Optional) Specifies the source port number. To specify a range, separate the port numbers with a dash (-), For example:
1000-2000state state_type
(Optional) Specifies the connection state type. See Table 7-9 for a list of the keywords available for connection state types.
Defaults
All through connections are shown by default.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show conn command displays the number of active TCP and UDP connections, and provides information about connections of various types. Use the show conn all command to see the entire table of connections.
Note
The connection types that you can specify using the show conn state command are defined in Table 7-9. When specifying multiple connection types, use commas without spaces to separate the keywords.
When you use the detail option, the system displays information about the translation type and interface information using the connection flags defined in Table 7-10.
Table 7-10 Connection Flags
a
awaiting outside ACK to SYN
A
awaiting inside ACK to SYN
B
initial SYN from outside
C
Computer Telephony Interface Quick Buffer Encoding (CTIQBE) media connection
d
dump
D
DNS
E
outside back connection
f
inside FIN
F
outside FIN
g
Media Gateway Control Protocol (MGCP) connection
G
connection is part of a group1
h
H.225
H
H.323
i
incomplete TCP or UDP connection
I
inbound data
k
Skinny Client Control Protocol (SCCP) media connection
m
SIP media connection
M
SMTP data
O
outbound data
p
replicated (unused)
P
inside back connection
q
SQL*Net data
r
inside acknowledged FIN
R
outside acknowledged FIN for TCP connection
R
UDP RPC2
s
awaiting outside SYN
S
awaiting inside SYN
t
SIP transient connection3
T
SIP connection4
U
up
1 The G flag indicates the connection is part of a group. It is set by the GRE and FTP Strict fixups to designate the control connection and all its associated secondary connections. If the control connection terminates, then all associated secondary connections are also terminated.
2 Because each row of show conn command output represents one connection (TCP or UDP ), there will be only one R flag per row.
3 For UDP connections, the value t indicates that it will timeout after one minute.
4 For UDP connections, the value T indicates that the connection will timeout according to the value specified using the timeout sip command.
Note
A single connection is created for multiple DNS sessions, as long as they are between the same two hosts, and the sessions have the same 5-tuple (source/destination IP address, source/destination port, and protocol). DNS identification is tracked by app_id, and the idle timer for each app_id runs independently.
Because the app_id expires independently, a legitimate DNS response can only pass through the security appliance within a limited period of time and there is no resource build-up. However, when you enter the show conn command, you will see the idle timer of a DNS connection being reset by a new DNS session. This is due to the nature of the shared DNS connection and is by design.
Note
Examples
When specifying multiple connection types, use commas without spaces to separate the keywords. The following example displays information about RPC, H.323, and SIP connections in the Up state:
hostname# show conn state up,rpc,h323,sipThe following is sample output from the show conn count command:
ciscoasa(config)# show conn count22 in use, 27775 most usedThe following is sample output from the show conn command. This example shows a TCP session connection from inside host 10.1.1.15 to the outside Telnet server at 10.2.49.10. Because there is no B flag, the connection is initiated from the inside. The "U", "I", and "O" flags denote that the connection is active and has received inbound and outbound data.
hostname# show conn22 in use, 27775 most usedTCP out 10.2.49.10:23 in 10.1.1.15:1026 idle 0:00:22 bytes 1774 flags UIOUDP out 10.2.49.10:31649 in 10.1.1.15:1028 idle 0:00:14 bytes 0 flags D-TCP out 10.30.2.2:1500 in 10.1.1.7:1000 idle 0:00:00 bytes 0 flags saATCP out 10.30.2.2:1500 in 10.1.1.14:1000 idle 0:00:00 bytes 0 flags saATCP out 10.30.2.2:1500 in 10.1.1.1:1000 idle 0:00:00 bytes 0 flags saATCP out 10.30.2.2:1500 in 10.1.1.3:1000 idle 0:00:00 bytes 0 flags saATCP out 10.30.2.2:80 in 10.30.1.1:45804 idle 0:01:26 bytes 7918 flags UFRIOTCP out 10.30.2.2:80 in 10.30.1.1:45003 idle 0:02:17 bytes 7918 flags UFRIOThe following is sample output from the show conn detail command. This example shows many connections, including a UDP connection from outside host 192.168.49.10 to inside host 10.1.1.15. The D flag denotes that this is a DNS connection. The number 1028 is the DNS ID over the connection.
hostname# show conn detail22 in use, 27775 most usedFlags: A - awaiting inside ACK to SYN, a - awaiting outside ACK to SYN,B - initial SYN from outside, C - CTIQBE media, D - DNS, d - dump,E - outside back connection, F - outside FIN, f - inside FIN,G - group, g - MGCP, H - H.323, h - H.225.0, I - inbound data,i - incomplete, J - GTP, j - GTP data, K - GTP t3-responsek - Skinny media, M - SMTP data, m - SIP media, O - outbound data,P - inside back connection, q - SQL*Net data, R - outside acknowledged FIN,R - UDP SUNRPC, r - inside acknowledged FIN, S - awaiting inside SYN,s - awaiting outside SYN, T - SIP, t - SIP transient, U - upTCP outside:10.30.2.2/1500 inside:10.1.1.7/1000 flags saATCP outside:10.30.2.2/1500 inside:10.1.1.14/1000 flags saATCP outside:10.30.2.2/1500 inside:10.1.1.1/1000 flags saATCP outside:10.30.2.2/1500 inside:10.1.1.3/1000 flags saATCP outside:10.30.2.2/80 inside:10.30.1.1/45804 flags UFRIOTCP outside:10.30.2.2/80 inside:10.30.1.1/45003 flags UFRIOTCP outside:192.168.49.10/23 inside:10.1.1.15/1026 flags UIOUDP outside:192.168.49.10/31649 inside:10.1.1.15/1028 flags dDRelated Commands
show console-output
To display the currently captured console output, use the show console-output command in privileged EXEC mode.
show console-output
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
·
Command History
Examples
The following example shows the message that displays when there is no console output:
hostname# show console-outputSorry, there are no messages to displayRelated Commands
show context
To show context information including allocated interfaces and the configuration file URL, the number of contexts configured, or from the system execution space, a list of all contexts, use the show context command in privileged EXEC mode.
show context [name | detail | count]
Syntax Description
Defaults
In the system execution space, the security appliance displays all contexts if you do not specify a name.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show context command. The following sample display shows three contexts:
hostname# show contextContext Name Interfaces URL*admin GigabitEthernet0/1.100 flash:/admin.cfgGigabitEthernet0/1.101contexta GigabitEthernet0/1.200 flash:/contexta.cfgGigabitEthernet0/1.201contextb GigabitEthernet0/1.300 flash:/contextb.cfgGigabitEthernet0/1.301Total active Security Contexts: 3Table 7-11 shows each field description.
The following is sample output from the show context detail command:
hostname# show context detailContext "admin", has been created, but initial ACL rules not completeConfig URL: flash:/admin.cfgReal Interfaces: Management0/0Mapped Interfaces: Management0/0Flags: 0x00000013, ID: 1Context "ctx", has been created, but initial ACL rules not completeConfig URL: ctx.cfgReal Interfaces: GigabitEthernet0/0.10, GigabitEthernet0/1.20,GigabitEthernet0/2.30Mapped Interfaces: int1, int2, int3Flags: 0x00000011, ID: 2Context "system", is a system resourceConfig URL: startup-configReal Interfaces:Mapped Interfaces: Control0/0, GigabitEthernet0/0,GigabitEthernet0/0.10, GigabitEthernet0/1, GigabitEthernet0/1.10,GigabitEthernet0/1.20, GigabitEthernet0/2, GigabitEthernet0/2.30,GigabitEthernet0/3, Management0/0, Management0/0.1Flags: 0x00000019, ID: 257Context "null", is a system resourceConfig URL: ... null ...Real Interfaces:Mapped Interfaces:Flags: 0x00000009, ID: 258Table 7-12 shows each field description.
The following is sample output from the show context count command:
hostname# show context countTotal active contexts: 2Related Commands
show counters
To display the protocol stack counters, use the show counters command in privileged EXEC mode.
show counters [all | context context-name | summary | top N ] [detail] [protocol protocol_name [:counter_name]] [ threshold N]
Syntax Description
Defaults
show counters summary detail threshold 1
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following example shows how to display all counters:
hostname# show counters allProtocol Counter Value ContextIOS_IPC IN_PKTS 2 single_vfIOS_IPC OUT_PKTS 2 single_vfhostname# show countersProtocol Counter Value ContextNPCP IN_PKTS 7195 SummaryNPCP OUT_PKTS 7603 SummaryIOS_IPC IN_PKTS 869 SummaryIOS_IPC OUT_PKTS 865 SummaryIP IN_PKTS 380 SummaryIP OUT_PKTS 411 SummaryIP TO_ARP 105 SummaryIP TO_UDP 9 SummaryUDP IN_PKTS 9 SummaryUDP DROP_NO_APP 9 SummaryFIXUP IN_PKTS 202 SummaryThe following example shows how to display a summary of counters:
hostname# show counters summaryProtocol Counter Value ContextIOS_IPC IN_PKTS 2 SummaryIOS_IPC OUT_PKTS 2 SummaryThe following example shows how to display counters for a context:
hostname# show counters context single_vfProtocol Counter Value ContextIOS_IPC IN_PKTS 4 single_vfIOS_IPC OUT_PKTS 4 single_vfRelated Commands
show cpu
To display the CPU utilization information, use the show cpu usage command in privileged EXEC mode.
show cpu [usage]
From the system configuration in multiple context mode:
show cpu [usage] [context {all | context_name}]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The cpu usage is computed using an approximation of the load every five seconds, and by further feeding this approximation into two, following moving averages.
You can use the show cpu command to find process related loads (that is, activity on behalf of items listed by the output of the show process command in both single mode and from the system configuration in multiple context mode).
Further, you can request, when in multiple context mode, a breakdown of the process related load to CPU consumed by any configured contexts by changing to each context and entering the show cpu command or by entering the show cpu context variant of this command.
While process related load is rounded to the nearest whole number, context related loads include one additional decimal digit of precision. For example, entering show cpu from the system context produces a different number than from entering the show cpu context system command. The former is an approximate summary of everything in show cpu context all, and the latter is only a portion of that summary.
Examples
The following example shows how to display the CPU utilization:
hostname# show cpu usageCPU utilization for 5 seconds = 18%; 1 minute: 18%; 5 minutes: 18%This example shows how to display the CPU utilization for the system context in multiple mode:
hostname# show cpu context systemCPU utilization for 5 seconds = 9.1%; 1 minute: 9.2%; 5 minutes: 9.1%The following shows how to display the CPU utilization for all contexts:
hostname# show cpu usage context all5 sec 1 min 5 min Context Name9.1% 9.2% 9.1% system0.0% 0.0% 0.0% admin5.0% 5.0% 5.0% one4.2% 4.3% 4.2% twoThis example shows how to display the CPU utilization for a context named "one":
hostname/one# show cpu usageCPU utilization for 5 seconds = 5.0%; 1 minute: 5.0%; 5 minutes: 5.0%Related Commands
show crashinfo
To display the contents of the crash file stored in Flash memory, enter the show crashinfo command in privileged EXEC mode.
show crashinfo [save]
Syntax Description
save
(Optional) Displays if the security appliance is configured to save crash information to Flash memory or not.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
If the crash file is from a test crash (generated from the crashinfo test command), the first string of the crash file is ": Saved_Test_Crash" and the last string is ": End_Test_Crash". If the crash file is from a real crash, the first string of the crash file is ": Saved_Crash" and the last string is ": End_Crash". (This includes crashes from use of the crashinfo force page-fault or crashinfo force watchdog commands).
If there is no crash data saved in flash, or if the crash data has been cleared by entering the clear crashinfo command, the show crashinfo command displays an error message.
Examples
The following example shows how to display the current crash information configuration:
hostname# show crashinfo savecrashinfo save enableThe following example shows the output for a crash file test. (However, this test does not actually crash the security appliance. It provides a simulated example file.)
hostname(config)# crashinfo testhostname(config)# exithostname# show crashinfo: Saved_Test_CrashThread Name: ci/console (Old pc 0x001a6ff5 ebp 0x00e88920)Traceback:0: 003231431: 0032321b2: 0010885c3: 0010763c4: 001078db5: 001035856: 00000000vector 0x000000ff (user defined)edi 0x004f20c4esi 0x00000000ebp 0x00e88c20esp 0x00e88bd8ebx 0x00000001edx 0x00000074ecx 0x00322f8beax 0x00322f8berror code n/aeip 0x0010318ccs 0x00000008eflags 0x00000000CR2 0x00000000Stack dump: base:0x00e8511c size:16384, active:14760x00e89118: 0x004f1bb40x00e89114: 0x001078b40x00e89110-0x00e8910c: 0x000000000x00e89108-0x00e890ec: 0x123456780x00e890e8: 0x004f1bb40x00e890e4: 0x001035850x00e890e0: 0x00e8910c0x00e890dc-0x00e890cc: 0x123456780x00e890c8: 0x000000000x00e890c4-0x00e890bc: 0x123456780x00e890b8: 0x004f1bb40x00e890b4: 0x001078db0x00e890b0: 0x00e890e00x00e890ac-0x00e890a8: 0x123456780x00e890a4: 0x001179b30x00e890a0: 0x00e890b00x00e8909c-0x00e89064: 0x123456780x00e89060: 0x123456000x00e8905c: 0x202329700x00e89058: 0x616d2d650x00e89054: 0x740020230x00e89050: 0x296769660x00e8904c: 0x6e6f63280x00e89048: 0x316365730x00e89044: 0x7069636f0x00e89040: 0x647869700x00e8903c-0x00e88e50: 0x000000000x00e88e4c: 0x000a74730x00e88e48: 0x6574206f0x00e88e44: 0x666e69680x00e88e40: 0x736172630x00e88e3c-0x00e88e38: 0x000000000x00e88e34: 0x123456000x00e88e30-0x00e88dfc: 0x000000000x00e88df8: 0x003167610x00e88df4: 0x747061000x00e88df0: 0x123456000x00e88dec-0x00e88ddc: 0x000000000x00e88dd8: 0x000000700x00e88dd4: 0x616d2d650x00e88dd0: 0x74756f000x00e88dcc: 0x000000000x00e88dc8: 0x00e88e400x00e88dc4: 0x004f20c40x00e88dc0: 0x123456000x00e88dbc: 0x000000000x00e88db8: 0x000000350x00e88db4: 0x315f656c0x00e88db0: 0x62616e650x00e88dac: 0x0030fcf00x00e88da8: 0x3011111f0x00e88da4: 0x004df43c0x00e88da0: 0x0053fef00x00e88d9c: 0x004f1bb40x00e88d98: 0x123456000x00e88d94: 0x000000000x00e88d90: 0x000000350x00e88d8c: 0x315f656c0x00e88d88: 0x62616e650x00e88d84: 0x000000000x00e88d80: 0x004f20c40x00e88d7c: 0x000000010x00e88d78: 0x013456780x00e88d74: 0x00f538540x00e88d70: 0x00f7f7540x00e88d6c: 0x00e88db00x00e88d68: 0x00e88d7b0x00e88d64: 0x00f538740x00e88d60: 0x00e890400x00e88d5c-0x00e88d54: 0x123456780x00e88d50-0x00e88d4c: 0x000000000x00e88d48: 0x004f1bb40x00e88d44: 0x00e88d7c0x00e88d40: 0x00e88e400x00e88d3c: 0x00f538740x00e88d38: 0x004f1bb40x00e88d34: 0x0010763c0x00e88d30: 0x00e890b00x00e88d2c: 0x00e88db00x00e88d28: 0x00e88d880x00e88d24: 0x0010761a0x00e88d20: 0x00e890b00x00e88d1c: 0x00e88e400x00e88d18: 0x00f538740x00e88d14: 0x0010166d0x00e88d10: 0x0000000e0x00e88d0c: 0x00f538740x00e88d08: 0x00f538540x00e88d04: 0x0048b3010x00e88d00: 0x00e88d300x00e88cfc: 0x0000000e0x00e88cf8: 0x00f538540x00e88cf4: 0x0048a4010x00e88cf0: 0x00f538540x00e88cec: 0x00f538740x00e88ce8: 0x0000000e0x00e88ce4: 0x0048a64b0x00e88ce0: 0x0000000e0x00e88cdc: 0x00f538740x00e88cd8: 0x00f7f96c0x00e88cd4: 0x0048b4f80x00e88cd0: 0x00e88d000x00e88ccc: 0x0000000f0x00e88cc8: 0x00f7f96c0x00e88cc4-0x00e88cc0: 0x0000000e0x00e88cbc: 0x00e890400x00e88cb8: 0x000000000x00e88cb4: 0x00f5387e0x00e88cb0: 0x00f538740x00e88cac: 0x000000020x00e88ca8: 0x000000010x00e88ca4: 0x000000090x00e88ca0-0x00e88c9c: 0x000000010x00e88c98: 0x00e88cb00x00e88c94: 0x004f20c40x00e88c90: 0x0000003a0x00e88c8c: 0x000000000x00e88c88: 0x0000000a0x00e88c84: 0x00489f3a0x00e88c80: 0x00e88d880x00e88c7c: 0x00e88e400x00e88c78: 0x00e88d7c0x00e88c74: 0x001087ed0x00e88c70: 0x000000010x00e88c6c: 0x00e88cb00x00e88c68: 0x000000020x00e88c64: 0x0010885c0x00e88c60: 0x00e88d300x00e88c5c: 0x007273340x00e88c58: 0xa0ffffff0x00e88c54: 0x00e88cb00x00e88c50: 0x000000010x00e88c4c: 0x00e88cb00x00e88c48: 0x000000020x00e88c44: 0x0032321b0x00e88c40: 0x00e88c600x00e88c3c: 0x00e88c7f0x00e88c38: 0x00e88c5c0x00e88c34: 0x004b1ad50x00e88c30: 0x00e88c600x00e88c2c: 0x00e88e400x00e88c28: 0xa0ffffff0x00e88c24: 0x003231430x00e88c20: 0x00e88c400x00e88c1c: 0x000000000x00e88c18: 0x000000080x00e88c14: 0x0010318c0x00e88c10-0x00e88c0c: 0x00322f8b0x00e88c08: 0x000000740x00e88c04: 0x000000010x00e88c00: 0x00e88bd80x00e88bfc: 0x00e88c200x00e88bf8: 0x000000000x00e88bf4: 0x004f20c40x00e88bf0: 0x000000ff0x00e88bec: 0x00322f870x00e88be8: 0x00f5387e0x00e88be4: 0x003230210x00e88be0: 0x00e88c100x00e88bdc: 0x004f20c40x00e88bd8: 0x00000000 *0x00e88bd4: 0x004eabb00x00e88bd0: 0x000000010x00e88bcc: 0x00f5387e0x00e88bc8-0x00e88bc4: 0x000000000x00e88bc0: 0x000000080x00e88bbc: 0x0010318c0x00e88bb8-0x00e88bb4: 0x00322f8b0x00e88bb0: 0x000000740x00e88bac: 0x000000010x00e88ba8: 0x00e88bd80x00e88ba4: 0x00e88c200x00e88ba0: 0x000000000x00e88b9c: 0x004f20c40x00e88b98: 0x000000ff0x00e88b94: 0x001031f20x00e88b90: 0x00e88c200x00e88b8c: 0xffffffff0x00e88b88: 0x00e88cb00x00e88b84: 0x003200320x00e88b80: 0x373031330x00e88b7c: 0x312f65740x00e88b78: 0x6972772f0x00e88b74: 0x342f76650x00e88b70: 0x647366660x00e88b6c: 0x000200000x00e88b68: 0x000000100x00e88b64: 0x000000010x00e88b60: 0x123456cd0x00e88b5c: 0x000000000x00e88b58: 0x00000008Cisco XXX Firewall Version X.XCisco XXX Device Manager Version X.XCompiled on Fri 15-Nov-04 14:35 by roothostname up 10 days 0 hoursHardware: XXX-XXX, 64 MB RAM, CPU Pentium 200 MHzFlash i28F640J5 @ 0x300, 16MBBIOS Flash AT29C257 @ 0xfffd8000, 32KB0: ethernet0: address is 0003.e300.73fd, irq 101: ethernet1: address is 0003.e300.73fe, irq 72: ethernet2: address is 00d0.b7c8.139e, irq 9Licensed Features:Failover: DisabledVPN-DES: EnabledVPN-3DES-AES: DisabledMaximum Interfaces: 3Cut-through Proxy: EnabledGuards: EnabledURL-filtering: EnabledInside Hosts: UnlimitedThroughput: UnlimitedIKE peers: UnlimitedThis XXX has a Restricted (R) license.Serial Number: 480430455 (0x1ca2c977)Running Activation Key: 0xc2e94182 0xc21d8206 0x15353200 0x633f6734Configuration last modified by enable_15 at 13:49:42.148 UTC Wed Nov 20 2004------------------ show clock ------------------15:34:28.129 UTC Sun Nov 24 2004------------------ show memory ------------------Free memory: 50444824 bytesUsed memory: 16664040 bytes------------- ----------------Total memory: 67108864 bytes------------------ show conn count ------------------0 in use, 0 most used------------------ show xlate count ------------------0 in use, 0 most used------------------ show blocks ------------------SIZE MAX LOW CNT4 1600 1600 160080 400 400 400256 500 499 5001550 1188 795 927------------------ show interface ------------------interface ethernet0 "outside" is up, line protocol is upHardware is i82559 ethernet, address is 0003.e300.73fdIP address 172.23.59.232, subnet mask 255.255.0.0MTU 1500 bytes, BW 10000 Kbit half duplex6139 packets input, 830375 bytes, 0 no bufferReceived 5990 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort90 packets output, 6160 bytes, 0 underruns0 output errors, 13 collisions, 0 interface resets0 babbles, 0 late collisions, 47 deferred0 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (5/128) software (0/2)output queue (curr/max blocks): hardware (0/1) software (0/1)interface ethernet1 "inside" is up, line protocol is downHardware is i82559 ethernet, address is 0003.e300.73feIP address 10.1.1.1, subnet mask 255.255.255.0MTU 1500 bytes, BW 10000 Kbit half duplex0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort1 packets output, 60 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred1 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (128/128) software (0/0)output queue (curr/max blocks): hardware (0/1) software (0/1)interface ethernet2 "intf2" is administratively down, line protocol is downHardware is i82559 ethernet, address is 00d0.b7c8.139eIP address 127.0.0.1, subnet mask 255.255.255.255MTU 1500 bytes, BW 10000 Kbit half duplex0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred0 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (128/128) software (0/0)output queue (curr/max blocks): hardware (0/0) software (0/0)------------------ show cpu usage ------------------CPU utilization for 5 seconds = 0%; 1 minute: 0%; 5 minutes: 0%------------------ show process ------------------PC SP STATE Runtime SBASE Stack ProcessHsi 001e3329 00763e7c 0053e5c8 0 00762ef4 3784/4096 arp_timerLsi 001e80e9 00807074 0053e5c8 0 008060fc 3792/4096 FragDBGCLwe 00117e3a 009dc2e4 00541d18 0 009db46c 3704/4096 dbgtraceLwe 003cee95 009de464 00537718 0 009dc51c 8008/8192 LoggerHwe 003d2d18 009e155c 005379c8 0 009df5e4 8008/8192 tcp_fastHwe 003d2c91 009e360c 005379c8 0 009e1694 8008/8192 tcp_slowLsi 002ec97d 00b1a464 0053e5c8 0 00b194dc 3928/4096 xlate cleanLsi 002ec88b 00b1b504 0053e5c8 0 00b1a58c 3888/4096 uxlate cleanMrd 002e3a17 00c8f8d4 0053e600 0 00c8d93c 7908/8192 tcp_intercept_timesLsi 00423dd5 00d3a22c 0053e5c8 0 00d392a4 3900/4096 route_processHsi 002d59fc 00d3b2bc 0053e5c8 0 00d3a354 3780/4096 PIX Garbage CollecrHwe 0020e301 00d5957c 0053e5c8 0 00d55614 16048/16384 isakmp_time_keeprLsi 002d377c 00d7292c 0053e5c8 0 00d719a4 3928/4096 perfmonHwe 0020bd07 00d9c12c 0050bb90 0 00d9b1c4 3944/4096 IPSecMwe 00205e25 00d9e1ec 0053e5c8 0 00d9c274 7860/8192 IPsec timer handlerHwe 003864e3 00db26bc 00557920 0 00db0764 6904/8192 qos_metric_daemonMwe 00255a65 00dc9244 0053e5c8 0 00dc8adc 1436/2048 IP BackgroundLwe 002e450e 00e7bb94 00552c30 0 00e7ad1c 3704/4096 pix/traceLwe 002e471e 00e7cc44 00553368 0 00e7bdcc 3704/4096 pix/tconsoleHwe 001e5368 00e7ed44 00730674 0 00e7ce9c 7228/8192 pix/intf0Hwe 001e5368 00e80e14 007305d4 0 00e7ef6c 7228/8192 pix/intf1Hwe 001e5368 00e82ee4 00730534 2470 00e8103c 4892/8192 pix/intf2H* 001a6ff5 0009ff2c 0053e5b0 4820 00e8511c 12860/16384 ci/consoleCsi 002dd8ab 00e8a124 0053e5c8 0 00e891cc 3396/4096 update_cpu_usageHwe 002cb4d1 00f2bfbc 0051e360 0 00f2a134 7692/8192 uauth_inHwe 003d17d1 00f2e0bc 00828cf0 0 00f2c1e4 7896/8192 uauth_threadHwe 003e71d4 00f2f20c 00537d20 0 00f2e294 3960/4096 udp_timerHsi 001db3ca 00f30fc4 0053e5c8 0 00f3004c 3784/4096 557mcfixCrd 001db37f 00f32084 0053ea40 508286220 00f310fc 3688/4096 557pollLsi 001db435 00f33124 0053e5c8 0 00f321ac 3700/4096 557timerHwe 001e5398 00f441dc 008121e0 0 00f43294 3912/4096 fover_ip0Cwe 001dcdad 00f4523c 00872b48 120 00f44344 3528/4096 ip/0:0Hwe 001e5398 00f4633c 008121bc 10 00f453f4 3532/4096 icmp0Hwe 001e5398 00f47404 00812198 0 00f464cc 3896/4096 udp_thread/0Hwe 001e5398 00f4849c 00812174 0 00f475a4 3456/4096 tcp_thread/0Hwe 001e5398 00f495bc 00812150 0 00f48674 3912/4096 fover_ip1Cwe 001dcdad 00f4a61c 008ea850 0 00f49724 3832/4096 ip/1:1Hwe 001e5398 00f4b71c 0081212c 0 00f4a7d4 3912/4096 icmp1Hwe 001e5398 00f4c7e4 00812108 0 00f4b8ac 3896/4096 udp_thread/1Hwe 001e5398 00f4d87c 008120e4 0 00f4c984 3832/4096 tcp_thread/1Hwe 001e5398 00f4e99c 008120c0 0 00f4da54 3912/4096 fover_ip2Cwe 001e542d 00f4fa6c 00730534 0 00f4eb04 3944/4096 ip/2:2Hwe 001e5398 00f50afc 0081209c 0 00f4fbb4 3912/4096 icmp2Hwe 001e5398 00f51bc4 00812078 0 00f50c8c 3896/4096 udp_thread/2Hwe 001e5398 00f52c5c 00812054 0 00f51d64 3832/4096 tcp_thread/2Hwe 003d1a65 00f78284 008140f8 0 00f77fdc 300/1024 listen/http1Mwe 0035cafa 00f7a63c 0053e5c8 0 00f786c4 7640/8192 Crypto CA------------------ show failover ------------------No license for Failover------------------ show traffic ------------------outside:received (in 865565.090 secs):6139 packets 830375 bytes0 pkts/sec 0 bytes/sectransmitted (in 865565.090 secs):90 packets 6160 bytes0 pkts/sec 0 bytes/secinside:received (in 865565.090 secs):0 packets 0 bytes0 pkts/sec 0 bytes/sectransmitted (in 865565.090 secs):1 packets 60 bytes0 pkts/sec 0 bytes/secintf2:received (in 865565.090 secs):0 packets 0 bytes0 pkts/sec 0 bytes/sectransmitted (in 865565.090 secs):0 packets 0 bytes0 pkts/sec 0 bytes/sec------------------ show perfmon ------------------PERFMON STATS: Current AverageXlates 0/s 0/sConnections 0/s 0/sTCP Conns 0/s 0/sUDP Conns 0/s 0/sURL Access 0/s 0/sURL Server Req 0/s 0/sTCP Fixup 0/s 0/sTCPIntercept 0/s 0/sHTTP Fixup 0/s 0/sFTP Fixup 0/s 0/sAAA Authen 0/s 0/sAAA Author 0/s 0/sAAA Account 0/s 0/s: End_Test_CrashRelated Commands
show crashinfo console
To display the configuration setting of the crashinfo console command, enter the show crashinfo console command in privileged EXEC mode.
show crashinfo console
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
Compliance with FIPS 140-2 prohibits the distribution of Critical Secu rity Parameters (keys, passwords, etc.) outside of the crypto boundary (chassis). When the device crashes, due to an assert or checkheaps failure, it is possible that the stack or memory regions dumped to the console contain sensitive data. This output must be suppressed in FIPS-mode.
Examples
sw8-5520(config)# show crashinfo consolecrashinfo console enableRelated Commands
show crypto accelerator statistics
To display the global and accelerator-specific statistics from the hardware crypto accelerator MIB, use the show crypto accelerator statistics command in global configuration or privileged EXEC mode.
show crypto accelerator statistics
Syntax Description
This command has no keywords or variables.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following example entered in global configuration mode, displays global crypto accelerator statistics:
hostname # show crypto accelerator statisticsCrypto Accelerator Status-------------------------[Capacity]Supports hardware crypto: TrueSupports modular hardware crypto: FalseMax accelerators: 1Max crypto throughput: 100 MbpsMax crypto connections: 750[Global Statistics]Number of active accelerators: 1Number of non-operational accelerators: 0Input packets: 700Input bytes: 753488Output packets: 700Output error packets: 0Output bytes: 767496[Accelerator 0]Status: ActiveSoftware crypto engineSlot: 0Active time: 167 secondsTotal crypto transforms: 7Total dropped packets: 0[Input statistics]Input packets: 0Input bytes: 0Input hashed packets: 0Input hashed bytes: 0Decrypted packets: 0Decrypted bytes: 0[Output statistics]Output packets: 0Output bad packets: 0Output bytes: 0Output hashed packets: 0Output hashed bytes: 0Encrypted packets: 0Encrypted bytes: 0[Diffie-Hellman statistics]Keys generated: 0Secret keys derived: 0[RSA statistics]Keys generated: 0Signatures: 0Verifications: 0Encrypted packets: 0Encrypted bytes: 0Decrypted packets: 0Decrypted bytes: 0[DSA statistics]Keys generated: 0Signatures: 0Verifications: 0[SSL statistics]Outbound records: 0Inbound records: 0[RNG statistics]Random number requests: 98Random number request failures: 0[Accelerator 1]Status: ActiveEncryption hardware device : Cisco ASA-55x0 on-board accelerator(revision 0x0)Boot microcode : CNlite-MC-Boot-Cisco-1.2SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03IPSec microcode : CNlite-MC-IPSECm-MAIN-2.03Slot: 1Active time: 170 secondsTotal crypto transforms: 1534Total dropped packets: 0[Input statistics]Input packets: 700Input bytes: 753544Input hashed packets: 700Input hashed bytes: 736400Decrypted packets: 700Decrypted bytes: 719944[Output statistics]Output packets: 700Output bad packets: 0Output bytes: 767552Output hashed packets: 700Output hashed bytes: 744800Encrypted packets: 700Encrypted bytes: 728352[Diffie-Hellman statistics]Keys generated: 97Secret keys derived: 1[RSA statistics]Keys generated: 0Signatures: 0Verifications: 0Encrypted packets: 0Encrypted bytes: 0Decrypted packets: 0Decrypted bytes: 0[DSA statistics]Keys generated: 0Signatures: 0Verifications: 0[SSL statistics]Outbound records: 0Inbound records: 0[RNG statistics]Random number requests: 1Random number request failures: 0hostname #Related Commands
show crypto ca certificates
To display the certificates associated with a specific trustpoint or to display all the certificates installed on the system, use the show crypto ca certificates command in global configuration or privileged EXEC mode.
show crypto ca certificates [trustpointname]
Syntax Description
trustpointname
(Optional) The name of a trustpoint. If you do not specify a name, this command displays all certificates installed on the system.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following example entered in global configuration mode, displays a CA certificate for a trustpoint named tp1:
hostname(config)# show crypto ca certificates tp1CA CertificateStatus: AvailableCertificate Serial Number 2957A3FF296EF854FD0D6732FE25B45Certificate Usage: SignatureIssuer:CN = ms-root-sha-06-2004OU = rootouO = ciscoL = franklinST - massachusettsC = USEA = a@b.conSubject:CN = ms-root-sha-06-2004OU = rootouO = ciscoL = franklinST = massachusettsC = USEA = a@b.comCRL Distribution Pointldap://w2kadvancedsrv/CertEnroll/ms-root-sha-06-2004.crlValidity Date:start date: 14:11:40 UTC Jun 26 2004end date: 14:01:30 UTC Jun 4 2022Associated Trustpoints: tp2 tp1hostname(config)#Related Commands
show crypto ca crls
To display all cached CRLs or to display all CRLs cached for a specified trustpoint, use the show crypto ca crls command in global configuration or privileged EXEC mode.
show crypto ca crls [trustpointname]
Syntax Description
trustpointname
(Optional) The name of a trustpoint. If you do not specify a name, this command displays all CRLs cached on the system.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
Privileged EXEC
•
•
•
•
Command History
Examples
The following example entered in global configuration mode, displays a CRL for a trustpoint named tp1:
hostname(config)# show crypto ca crls tp1CRL Issuer Name:cn=ms-sub1-ca-5-2004,ou=Franklin DevTest,o=CiscoSystems,l=Franklin,st=MA,c=US,ea=user@cisco.comLastUpdate: 19:45:53 UTC Dec 24 2004NextUpdate: 08:05:53 UTC Jan 1 2005Retrieved from CRL Distribution Point:http://win2k-ad2.frk-ms-pki.cisco.com/CertEnroll/ms-sub1-ca-5-2004.crlAssociated Trustpoints: tp1hostname(config)#Related Commands
show crypto ipsec df-bit
To display the IPSec DF-bit policy for IPSec packets for a specified interface, use the show crypto ipsec df-bit command in global configuration mode and privileged EXEC mode.
show crypto ipsec df-bit interface
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following example displays the IPSec DF-bit policy for interface named inside:
hostname(config)# show crypto ipsec df-bit insidedf-bit inside copyhostname(config)#Related Commands
show crypto ipsec fragmentation
To display the fragmentation policy for IPSec packets, use the show crypto ipsec fragmentation command in global configuration or privileged EXEC modes.
show crypto ipsec fragmentation interface
Syntax Description
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following example, entered in global configuration mode, displays the IPSec fragmentation policy for an interface named inside:
hostname(config)# show crypto ipsec fragmentation insidefragmentation inside before-encryptionhostname(config)#Related Commands
show crypto key mypubkey
To display key pairs of the indicated type, use the show crypto key mypubkey command in global configuration or privileged EXEC mode.
show crypto key mypubkey {rsa | dsa}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
Command History
Examples
The following example entered in global configuration mode, displays RSA key pairs:
hostname(config)# show crypto key mypubkey rsa[Display]hostname(config)#Related Commands
crypto key generate dsa
Generates DSA key pairs.
crypto key generate rsa
Generates RSA key pairs.
crypto key zeroize
Removes all key pairs of the indicated type.
show crypto protocol statistics
To display the protocol-specific statistics in the crypto accelerator MIB, use the show crypto protocol statistics command in global configuration or privileged EXEC mode.
show crypto protocol statistics protocol
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following examples entered in global configuration mode, display crypto accelerator statistics for specified protocols:
hostname # show crypto protocol statistics ikev1[IKEv1 statistics]Encrypt packet requests: 39Encapsulate packet requests: 39Decrypt packet requests: 35Decapsulate packet requests: 35HMAC calculation requests: 84SA creation requests: 1SA rekey requests: 3SA deletion requests: 2Next phase key allocation requests: 2Random number generation requests: 0Failed requests: 0hostname # show crypto protocol statistics ipsec[IPsec statistics]Encrypt packet requests: 700Encapsulate packet requests: 700Decrypt packet requests: 700Decapsulate packet requests: 700HMAC calculation requests: 1400SA creation requests: 2SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0hostname # show crypto protocol statistics ssl[SSL statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0hostname # show crypto protocol statistics other[Other statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 99Failed requests: 0hostname # show crypto protocol statistics all[IKEv1 statistics]Encrypt packet requests: 46Encapsulate packet requests: 46Decrypt packet requests: 40Decapsulate packet requests: 40HMAC calculation requests: 91SA creation requests: 1SA rekey requests: 3SA deletion requests: 3Next phase key allocation requests: 2Random number generation requests: 0Failed requests: 0[IKEv2 statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0[IPsec statistics]Encrypt packet requests: 700Encapsulate packet requests: 700Decrypt packet requests: 700Decapsulate packet requests: 700HMAC calculation requests: 1400SA creation requests: 2SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0[SSL statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 0Failed requests: 0[SSH statistics are not supported][SRTP statistics are not supported][Other statistics]Encrypt packet requests: 0Encapsulate packet requests: 0Decrypt packet requests: 0Decapsulate packet requests: 0HMAC calculation requests: 0SA creation requests: 0SA rekey requests: 0SA deletion requests: 0Next phase key allocation requests: 0Random number generation requests: 99Failed requests: 0hostname #Related Commands
show ctiqbe
To display information about CTIQBE sessions established across the security appliance, use the show ctiqbe command in privileged EXEC mode.
show ctiqbe
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show ctiqbe command displays information of CTIQBE sessions established across the security appliance. Along with debug ctiqbe and show local-host, this command is used for troubleshooting CTIQBE inspection engine issues.
Note
Examples
The following is sample output from the show ctiqbe command under the following conditions. There is only one active CTIQBE session setup across the security appliance. It is established between an internal CTI device (for example, a Cisco IP SoftPhone) at local address 10.0.0.99 and an external Cisco Call Manager at 172.29.1.77, where TCP port 2748 is the Cisco CallManager. The heartbeat interval for the session is 120 seconds.
hostname# | show ctiqbeTotal: 1| LOCAL | FOREIGN | STATE | HEARTBEAT---------------------------------------------------------------1 | 10.0.0.99/1117 172.29.1.77/2748 | 1 | 120| RTP/RTCP: PAT xlates: mapped to 172.29.1.99(1028 | 1029)| MEDIA: Device ID 27 | Call ID 0| Foreign 172.29.1.99 | (1028 | 1029)| Local | 172.29.1.88 | (26822 | 26823)| ----------------------------------------------The CTI device has already registered with the CallManager. The device internal address and RTP listening port is PATed to 172.29.1.99 UDP port 1028. Its RTCP listening port is PATed to UDP 1029.
The line beginning with RTP/RTCP: PAT xlates: appears only if an internal CTI device has registered with an external CallManager and the CTI device address and ports are PATed to that external interface. This line does not appear if the CallManager is located on an internal interface, or if the internal CTI device address and ports are NATed to the same external interface that is used by the CallManager.
The output indicates a call has been established between this CTI device and another phone at 172.29.1.88. The RTP and RTCP listening ports of the other phone are UDP 26822 and 26823. The other phone locates on the same interface as the CallManager because the security appliance does not maintain a CTIQBE session record associated with the second phone and CallManager. The active call leg on the CTI device side can be identified with Device ID 27 and Call ID 0.
The following is the xlate information for these CTIBQE connections:
hostname# show xlate debug3 in use, 3 most usedFlags: D | DNS, d | dump, I | identity, i | inside, n | no random,| o | outside, r | portmap, s | staticTCP PAT from inside:10.0.0.99/1117 to outside:172.29.1.99/1025 flags ri idle 0:00:22 timeout 0:00:30UDP PAT from inside:10.0.0.99/16908 to outside:172.29.1.99/1028 flags ri idle 0:00:00 timeout 0:04:10UDP PAT from inside:10.0.0.99/16909 to outside:172.29.1.99/1029 flags ri idle 0:00:23 timeout 0:04:10Related Commands
show curpriv
To display the current user privileges, use the show curpriv command:
show curpriv
Syntax Description
This command has no arguments or keywords.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
—
•
Privileged EXEC
•
•
—
—
•
Unprivileged
•
•
—
—
•
Command History
Usage Guidelines
The show curpriv command displays the current privilege level. Lower privilege level numbers indicate lower privilege levels.
Examples
These examples show output from the show curpriv command when a user named enable_15 is at different privilege levels. The username indicates the name that the user entered when the user logged in, P_PRIV indicates that the user has entered the enable command, and P_CONF indicates that the user has entered the config terminal command.
hostname(config)# show curprivUsername : enable_15Current privilege level : 15Current Mode/s : P_PRIV P_CONFhostname(config)# exithostname(config)# show curprivUsername : enable_15Current privilege level : 15Current Mode/s : P_PRIVhostname(config)# exithostname(config)# show curprivUsername : enable_1Current privilege level : 1Current Mode/s : P_UNPRhostname(config)#Related Commands
clear configure privilege
Remove privilege command statements from the configuration.
show running-config privilege
Display privilege levels for commands.
show debug
To show the current debugging configuration, use the show debug command.
show debug [command [keywords]]
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The valid command values follow. For information about valid syntax after command, see the entry for debug command, as applicable.
Note
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following commands enable debugging for authentication, accounting, and Flash memory. The show debug command is used in three ways to demonstrate how you can use it to view all debugging configuration, debugging configuration for a specific feature, and even debugging configuration for a subset of a feature.
hostname# debug aaa authenticationdebug aaa authentication enabled at level 1hostname# debug aaa accountingdebug aaa accounting enabled at level 1hostname# debug disk filesystemdebug disk filesystem enabled at level 1hostname# show debugdebug aaa authentication enabled at level 1debug aaa accounting enabled at level 1debug disk filesystem enabled at level 1hostname# show debug aaadebug aaa authentication enabled at level 1debug aaa authorization is disabled.debug aaa accounting enabled at level 1debug aaa internal is disabled.debug aaa vpn is disabled.hostname# show debug aaa accountingdebug aaa accounting enabled at level 1hostname#Related Commands
show dhcpd
To view DHCP binding, state, and statistical information, use the show dhcpd command in privileged EXEC or global configuration mode.
show dhcpd {binding [IP_address] | state | statistics}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
If you include the optional IP address in the show dhcpd binding command, only the binding for that IP address is shown.
The show dhcpd binding | state | statistics commands are also available in global configuration mode.
Examples
The following is sample output from the show dhcpd binding command:
hostname# show dhcpd bindingIP Address Hardware Address Lease Expiration Type10.0.1.100 0100.a0c9.868e.43 84985 seconds automaticThe following is sample output from the show dhcpd state command:
hostname# show dhcpd stateContext Not Configured for DHCPInterface outside, Not Configured for DHCPInterface inside, Not Configured for DHCPThe following is sample output from the show dhcpd statistics command:
hostname# show dhcpd statisticsDHCP UDP Unreachable Errors: 0DHCP Other UDP Errors: 0Address pools 1Automatic bindings 1Expired bindings 1Malformed messages 0Message ReceivedBOOTREQUEST 0DHCPDISCOVER 1DHCPREQUEST 2DHCPDECLINE 0DHCPRELEASE 0DHCPINFORM 0Message SentBOOTREPLY 0DHCPOFFER 1DHCPACK 1DHCPNAK 1Related Commands
show dhcprelay state
To view the state of the DHCP relay agent, use the show dhcprelay state command in privileged EXEC or global configuration mode.
show dhcprelay state
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
This command displays the DHCP relay agent state information for the current context and each interface.
Examples
The following is sample output from the show dhcprelay state command:
hostname# show dhcprelay stateContext Configured as DHCP RelayInterface outside, Not Configured for DHCPInterface infrastructure, Configured for DHCP RELAY SERVERInterface inside, Configured for DHCP RELAYRelated Commands
show dhcprelay statistics
To display the DHCP relay statistics, use the show dhcprelay statistics command in privileged EXEC mode.
show dhcprelay statistics
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
The output of the show dhcprelay statistics command increments until you enter the clear dhcprelay statistics command.
Examples
The following shows sample output for the show dhcprelay statistics command:
hostname# show dhcprelay statisticsDHCP UDP Unreachable Errors: 0DHCP Other UDP Errors: 0Packets RelayedBOOTREQUEST 0DHCPDISCOVER 7DHCPREQUEST 3DHCPDECLINE 0DHCPRELEASE 0DHCPINFORM 0BOOTREPLY 0DHCPOFFER 7DHCPACK 3DHCPNAK 0FeralPix(config)#Related Commands
show disk
To display the contents of the Flash memory, use the show disk command in privileged EXEC mode. To view the Flash memory for a PIX security appliance, see the show flash command.
show disk[0 | 1] [filesys | all]
Syntax Description
Defaults
Shows the internal Flash memory by default.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
The following is sample output from the show disk command:
hostname# show disk-#- --length-- -----date/time------ path11 1301 Feb 21 2005 18:01:34 test.cfg12 1949 Feb 21 2005 20:13:36 test1.cfg13 2551 Jan 06 2005 10:07:36 test2.cfg14 609223 Jan 21 2005 07:14:18 test3.cfg15 1619 Jul 16 2004 16:06:48 test4.cfg16 3184 Aug 03 2004 07:07:00 old_running.cfg17 4787 Mar 04 2005 12:32:18 test5.cfg20 1792 Jan 21 2005 07:29:24 test6.cfg21 7765184 Mar 07 2005 19:38:30 test7.cfg22 1674 Nov 11 2004 02:47:52 test8.cfg23 1863 Jan 21 2005 07:29:18 test9.cfg24 1197 Jan 19 2005 08:17:48 test10.cfg25 608554 Jan 13 2005 06:20:54 backupconfig.cfg26 5124096 Feb 20 2005 08:49:28 cdisk127 5124096 Mar 01 2005 17:59:56 cdisk228 2074 Jan 13 2005 08:13:26 test11.cfg29 5124096 Mar 07 2005 19:56:58 cdisk330 1276 Jan 28 2005 08:31:58 lead31 7756788 Feb 24 2005 12:59:46 asdmfile.dbg32 7579792 Mar 08 2005 11:06:56 asdmfile1.dbg33 7764344 Mar 04 2005 12:17:46 asdmfile2.dbg34 5124096 Feb 24 2005 11:50:50 cdisk435 15322 Mar 04 2005 12:30:24 hs_err.log10170368 bytes available (52711424 bytes used)The following is sample output from the show disk filesys command:
hostname# show disk filesys******** Flash Card Geometry/Format Info ********COMPACT FLASH CARD GEOMETRYNumber of Heads: 4Number of Cylinders 978Sectors per Cylinder 32Sector Size 512Total Sectors 125184COMPACT FLASH CARD FORMATNumber of FAT Sectors 61Sectors Per Cluster 8Number of Clusters 15352Number of Data Sectors 122976Base Root Sector 123Base FAT Sector 1Base Data Sector 155Related Commands
dir
Displays the directory contents.
show flash
Displays the contents of the internal Flash memory.
show dns-hosts
To show the DNS cache, use the show dns-hosts command in privileged EXEC mode.The DNS cache includes dynamically learned entries from a DNS server as well as manually entered name and IP addresses using the name command.
show dns-hosts
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show dns-hosts command:
hostname# show dns-hostsHost Flags Age Type Address(es)ns2.example.com (temp, OK) 0 IP 10.102.255.44ns1.example.com (temp, OK) 0 IP 192.168.241.185snowmass.example.com (temp, OK) 0 IP 10.94.146.101server.example.com (temp, OK) 0 IP 10.94.146.80Table 7-11 shows each field description.
Related Commands
show failover
To display information about the failover status of the unit, use the show failover command in privileged EXEC mode.
show failover [group num | history | interface | state | statistics]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show failover command displays the dynamic failover information, interface status, and Stateful Failover statistics. The Stateful Failover Logical Update Statistics output appears only when Stateful Failover is enabled. The "xerr" and "rerr" values do not indicate errors in failover, but rather the number of packet transmit or receive errors.
In the show failover command output, the fields have the following values:
•
–
–
–
–
•
–
–
–
–
–
–
–
–
–
–
–
–
–
If you do not enter a failover IP address, the show failover command displays 0.0.0.0 for the IP address, and monitoring of the interfaces remain in a "waiting" state. You must set a failover IP address for failover to work.
Table 7-14 describes the interface states for failover.
In multiple configuration mode, only the show failover command is available in a security context; you cannot enter the optional keywords.
Examples
The following is sample output from the show failover command for Active/Standby Failover.
hostname# show failoverFailover OnCable status: N/A - LAN-based failover enabledFailover unit PrimaryFailover LAN Interface: fover Ethernet2 (up)Unit Poll frequency 1 seconds, holdtime 3 secondsInterface Poll frequency 15 secondsInterface Policy 1Monitored Interfaces 2 of 250 maximumfailover replication httpLast Failover at: 22:44:03 UTC Dec 8 2004This host: Primary - ActiveActive time: 13434 (sec)Interface inside (10.130.9.3): NormalInterface outside (10.132.9.3): NormalOther host: Secondary - Standby ReadyActive time: 0 (sec)Interface inside (10.130.9.4): NormalInterface outside (10.132.9.4): NormalStateful Failover Logical Update StatisticsLink : fover Ethernet2 (up)Stateful Obj xmit xerr rcv rerrGeneral 0 0 0 0sys cmd 1733 0 1733 0up time 0 0 0 0RPC services 0 0 0 0TCP conn 6 0 0 0UDP conn 0 0 0 0ARP tbl 106 0 0 0Xlate_Timeout 0 0 0 0VPN IKE upd 15 0 0 0VPN IPSEC upd 90 0 0 0VPN CTCP upd 0 0 0 0VPN SDI upd 0 0 0 0VPN DHCP upd 0 0 0 0Logical Update Queue InformationCur Max TotalRecv Q: 0 2 1733Xmit Q: 0 2 15225The following is sample output from the show failover command for Active/Active Failover.
hostname# show failoverFailover OnFailover unit PrimaryFailover LAN Interface: third GigabitEthernet0/2 (up)Unit Poll frequency 1 seconds, holdtime 15 secondsInterface Poll frequency 4 secondsInterface Policy 1Monitored Interfaces 8 of 250 maximumfailover replication httpGroup 1 last failover at: 13:40:18 UTC Dec 9 2004Group 2 last failover at: 13:40:06 UTC Dec 9 2004This host: PrimaryGroup 1 State: ActiveActive time: 2896 (sec)Group 2 State: Standby ReadyActive time: 0 (sec)slot 0: ASA-5530 hw/sw rev (1.0/7.0(0)79) status (Up Sys)slot 1: SSM-IDS-20 hw/sw rev (1.0/5.0(0.11)S91(0.11)) status (Up)admin Interface outside (10.132.8.5): Normaladmin Interface third (10.132.9.5): Normaladmin Interface inside (10.130.8.5): Normaladmin Interface fourth (10.130.9.5): Normalctx1 Interface outside (10.1.1.1): Normalctx1 Interface inside (10.2.2.1): Normalctx2 Interface outside (10.3.3.2): Normalctx2 Interface inside (10.4.4.2): NormalOther host: SecondaryGroup 1 State: Standby ReadyActive time: 190 (sec)Group 2 State: ActiveActive time: 3322 (sec)slot 0: ASA-5530 hw/sw rev (1.0/7.0(0)79) status (Up Sys)slot 1: SSM-IDS-20 hw/sw rev (1.0/5.0(0.1)S91(0.1)) status (Up)admin Interface outside (10.132.8.6): Normaladmin Interface third (10.132.9.6): Normaladmin Interface inside (10.130.8.6): Normaladmin Interface fourth (10.130.9.6): Normalctx1 Interface outside (10.1.1.2): Normalctx1 Interface inside (10.2.2.2): Normalctx2 Interface outside (10.3.3.1): Normalctx2 Interface inside (10.4.4.1): NormalStateful Failover Logical Update StatisticsLink : third GigabitEthernet0/2 (up)Stateful Obj xmit xerr rcv rerrGeneral 0 0 0 0sys cmd 380 0 380 0up time 0 0 0 0RPC services 0 0 0 0TCP conn 1435 0 1450 0UDP conn 0 0 0 0ARP tbl 124 0 65 0Xlate_Timeout 0 0 0 0VPN IKE upd 15 0 0 0VPN IPSEC upd 90 0 0 0VPN CTCP upd 0 0 0 0VPN SDI upd 0 0 0 0VPN DHCP upd 0 0 0 0Logical Update Queue InformationCur Max TotalRecv Q: 0 1 1895Xmit Q: 0 0 1940The following is sample output from the show failover state command for an active-active setup:
hostname(config)# show failover stateState Last Failure Reason Date/TimeThis host - SecondaryGroup 1 Failed Backplane Failure 03:42:29 UTC Apr 17 2009Group 2 Failed Backplane Failure 03:42:29 UTC Apr 17 2009Other host - PrimaryGroup 1 Active Comm Failure 03:41:12 UTC Apr 17 2009Group 2 Active Comm Failure 03:41:12 UTC Apr 17 2009====Configuration State===Sync Done====Communication State===Mac setThe following is sample output from the show failover state command for an active-standby setup:
hostname(config)# show failover stateState Last Failure Reason Date/TimeThis host - PrimaryNegotiation Backplane Failure 15:44:56 UTC Jun 20 2009Other host - SecondaryNot Detected Comm Failure 15:36:30 UTC Jun 20 2009====Configuration State===Sync Done====Communication State===Mac setTable 7-15 describes the output of the show failover state command.
Related Commands
show running-config failover
Displays the failover commands in the current configuration.
show file
To display information about the file system, use the show file command in privileged EXEC mode.
show file descriptors | system | information filename
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following example shows how to display the file system information:
hostname# show file descriptorsNo open file descriptorshostname# show file systemFile Systems:Size(b) Free(b) Type Flags Prefixes* 60985344 60973056 disk rw disk:Related Commands
dir
Displays the directory contents.
pwd
Displays the current working directory.
show firewall
To show the current firewall mode (routed or transparent), use the show firewall command in privileged EXEC mode.
show firewall
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following is sample output from the show firewall command:
hostname# show firewallFirewall mode: RouterRelated Commands
firewall transparent
Sets the firewall mode.
show mode
Shows the current context mode, either single or multiple.
show flash
To display the contents of the internal Flash memory, use the show flash: command in privileged EXEC mode.
show flash:
Note
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following example shows how to display the contents of the internal Flash memory:
hostname# show flash:-#- --length-- -----date/time------ path11 1301 Feb 21 2005 18:01:34 test.cfg12 1949 Feb 21 2005 20:13:36 pepsi.cfg13 2551 Jan 06 2005 10:07:36 Leo.cfg14 609223 Jan 21 2005 07:14:18 rr.cfg15 1619 Jul 16 2004 16:06:48 hackers.cfg16 3184 Aug 03 2004 07:07:00 old_running.cfg17 4787 Mar 04 2005 12:32:18 admin.cfg20 1792 Jan 21 2005 07:29:24 Marketing.cfg21 7765184 Mar 07 2005 19:38:30 asdmfile-RLK22 1674 Nov 11 2004 02:47:52 potts.cfg23 1863 Jan 21 2005 07:29:18 r.cfg24 1197 Jan 19 2005 08:17:48 tst.cfg25 608554 Jan 13 2005 06:20:54 500kconfig26 5124096 Feb 20 2005 08:49:28 cdisk7010227 5124096 Mar 01 2005 17:59:56 cdisk7010428 2074 Jan 13 2005 08:13:26 negateACL29 5124096 Mar 07 2005 19:56:58 cdisk7010530 1276 Jan 28 2005 08:31:58 steel31 7756788 Feb 24 2005 12:59:46 asdmfile.50074.dbg32 7579792 Mar 08 2005 11:06:56 asdmfile.gusingh33 7764344 Mar 04 2005 12:17:46 asdmfile.50075.dbg34 5124096 Feb 24 2005 11:50:50 cdisk7010335 15322 Mar 04 2005 12:30:24 hs_err_pid2240.log10170368 bytes available (52711424 bytes used)Related Commands
dir
Displays the directory contents.
show disk0
Displays the contents of the internal Flash memory.
show disk1
Displays the contents of the external Flash memory card.
show fragment
To display the operational data of the IP fragment reassembly module, enter the show fragment command in privileged EXEC mode.
show fragment [interface]
Syntax Description
Defaults
If an interface is not specified, the command applies to all interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC mode
·
·
·
·
Command History
7.0
The command was separated into two commands, show fragment and show running-config fragment, to separate the configuration data from the operational data.
Examples
This example shows how to display the operational data of the IP fragment reassembly module:
hostname# show fragmentInterface: insideSize: 200, Chain: 24, Timeout: 5, Reassembly: virtualQueue: 0, Assembled: 0, Fail: 0, Overflow: 0Interface: outside1Size: 200, Chain: 24, Timeout: 5, Reassembly: virtualQueue: 0, Assembled: 0, Fail: 0, Overflow: 0Interface: test1Size: 200, Chain: 24, Timeout: 5, Reassembly: virtualQueue: 0, Assembled: 0, Fail: 0, Overflow: 0Interface: test2Size: 200, Chain: 24, Timeout: 5, Reassembly: virtualQueue: 0, Assembled: 0, Fail: 0, Overflow: 0Related Commands
show gc
To display the garbage collection process statistics, use the show gc command in privileged EXEC mode.
show gc
Syntax Description
This command has no arguments or keywords.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following is sample output from the show gc command:
hostname# show gcGarbage collection process stats:Total tcp conn delete response : 0Total udp conn delete response : 0Total number of zombie cleaned : 0Total number of embryonic conn cleaned : 0Total error response : 0Total queries generated : 0Total queries with conn present response : 0Total number of sweeps : 946Total number of invalid vcid : 0Total number of zombie vcid : 0Related Commands
show h225
To display information for H.225 sessions established across the security appliance, use the show h225 command in privileged EXEC mode.
show h225
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show h225 command displays information for H.225 sessions established across the security appliance. Along with the debug h323 h225 event, debug h323 h245 event, and show local-host commands, this command is used for troubleshooting H.323 inspection engine issues.
Before using the show h225, show h245, or show h323-ras commands, we recommend that you configure the pager command. If there are a lot of session records and the pager command is not configured, it may take a while for the show output to reach its end. If there is an abnormally large number of connections, check that the sessions are timing out based on the default timeout values or the values set by you. If they are not, then there is a problem that needs to be investigated.
Examples
The following is sample output from the show h225 command:
hostname# show h225Total H.323 Calls: 11 Concurrent Call(s) for| Local: | 10.130.56.3/1040 | Foreign: 172.30.254.203/1720| 1. CRV 9861| Local: | 10.130.56.3/1040 | Foreign: 172.30.254.203/17200 Concurrent Call(s) for| Local: | 10.130.56.4/1050 | Foreign: 172.30.254.205/1720This output indicates that there is currently 1 active H.323 call going through the security appliance between the local endpoint 10.130.56.3 and foreign host 172.30.254.203, and for these particular endpoints, there is 1 concurrent call between them, with a CRV (Call Reference Value) for that call of 9861.
For the local endpoint 10.130.56.4 and foreign host 172.30.254.205, there are 0 concurrent Calls. This means that there is no active call between the endpoints even though the H.225 session still exists. This could happen if, at the time of the show h225 command, the call has already ended but the H.225 session has not yet been deleted. Alternately, it could mean that the two endpoints still have a TCP connection opened between them because they set "maintainConnection" to TRUE, so the session is kept open until they set it to FALSE again, or until the session times out based on the H.225 timeout value in your configuration.
Related Commands
show h245
To display information for H.245 sessions established across the security appliance by endpoints using slow start, use the show h245 command in privileged EXEC mode.
show h245
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show h245 command displays information for H.245 sessions established across the security appliance by endpoints using slow start. (Slow start is when the two endpoints of a call open another TCP control channel for H.245. Fast start is where the H.245 messages are exchanged as part of the H.225 messages on the H.225 control channel.) Along with the debug h323 h245 event, debug h323 h225 event, and show local-host commands, this command is used for troubleshooting H.323 inspection engine issues.
Examples
The following is sample output from the show h245 command:
hostname# show h245Total: 1| LOCAL | TPKT | FOREIGN | TPKT1 | 10.130.56.3/1041 | 0 | 172.30.254.203/1245 | 0| MEDIA: LCN 258 Foreign 172.30.254.203 RTP 49608 RTCP 49609| Local | 10.130.56.3 RTP 49608 RTCP 49609| MEDIA: LCN 259 Foreign 172.30.254.203 RTP 49606 RTCP 49607| Local | 10.130.56.3 RTP 49606 RTCP 49607There is currently one H.245 control session active across the security appliance. The local endpoint is 10.130.56.3, and we are expecting the next packet from this endpoint to have a TPKT header because the TPKT value is 0. (The TKTP header is a 4-byte header preceding each H.225/H.245 message. It gives the length of the message, including the 4-byte header.) The foreign host endpoint is 172.30.254.203, and we are expecting the next packet from this endpoint to have a TPKT header because the TPKT value is 0.
The media negotiated between these endpoints have a LCN (logical channel number) of 258 with the foreign RTP IP address/port pair of 172.30.254.203/49608 and a RTCP IP address/port of 172.30.254.203/49609 with a local RTP IP address/port pair of 10.130.56.3/49608 and a RTCP port of 49609.
The second LCN of 259 has a foreign RTP IP address/port pair of 172.30.254.203/49606 and a RTCP IP address/port pair of 172.30.254.203/49607 with a local RTP IP address/port pair of 10.130.56.3/49606 and RTCP port of 49607.
Related Commands
show h323-ras
To display information for H.323 RAS sessions established across the security appliance between a gatekeeper and its H.323 endpoint, use the show h323-ras command in privileged EXEC mode.
show h323-ras
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show h323-ras command displays information for H.323 RAS sessions established across the security appliance between a gatekeeper and its H.323 endpoint. Along with the debug h323 ras event and show local-host commands, this command is used for troubleshooting H.323 RAS inspection engine issues.
The show h323-ras command displays connection information for troubleshooting H.323 inspection engine issues, and is described in the inspect protocol h323 {h225 | ras} command page.
Examples
The following is sample output from the show h323-ras command:
hostname# show h323-rasTotal: 1| GK | Caller| 172.30.254.214 10.130.56.14This output shows that there is one active registration between the gatekeeper 172.30.254.214 and its client 10.130.56.14.
Related Commands
show history
To display the previously entered commands, use the show history command in user EXEC mode.
show history
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show history command lets you display previously entered commands. You can examine commands individually with the up and down arrows, enter ^p to display previously entered lines, or enter ^n to display the next line.
Examples
The following example shows how to display previously entered commands when you are in user EXEC mode:
hostname> show historyshow historyhelpshow historyThe following example shows how to display previously entered commands in privileged EXEC mode:
hostname# show historyshow historyhelpshow historyenableshow historyThis example shows how to display previously entered commands in global configuration mode:
hostname(config)# show historyshow historyhelpshow historyenableshow historyconfig tshow historyRelated Commands
show icmp
To display the ICMP configuration, use the show icmp command in privileged EXEC mode.
show icmp
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show icmp command displays the ICMP configuration.
Examples
The following example shows the ICMP configuration:
hostname# show icmpRelated Commands
show idb
To display information about the status of interface descriptor blocks, use the show idb command in privileged EXEC mode.
show idb
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
—
•
Command History
Usage Guidelines
IDBs are the internal data structure representing interface resources. See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show idb command:
hostname# show idbMaximum number of Software IDBs 280. In use 23.HWIDBs SWIDBsActive 6 21Inactive 1 2Total IDBs 7 23Size each (bytes) 116 212Total bytes 812 4876HWIDB# 1 0xbb68ebc Control0/0HWIDB# 2 0xcd47d84 GigabitEthernet0/0HWIDB# 3 0xcd4c1dc GigabitEthernet0/1HWIDB# 4 0xcd5063c GigabitEthernet0/2HWIDB# 5 0xcd54a9c GigabitEthernet0/3HWIDB# 6 0xcd58f04 Management0/0SWIDB# 1 0x0bb68f54 0x01010001 Control0/0SWIDB# 2 0x0cd47e1c 0xffffffff GigabitEthernet0/0SWIDB# 3 0x0cd772b4 0xffffffff GigabitEthernet0/0.1PEER IDB# 1 0x0d44109c 0xffffffff 3 GigabitEthernet0/0.1PEER IDB# 2 0x0d2c0674 0x00020002 2 GigabitEthernet0/0.1PEER IDB# 3 0x0d05a084 0x00010001 1 GigabitEthernet0/0.1SWIDB# 4 0x0bb7501c 0xffffffff GigabitEthernet0/0.2SWIDB# 5 0x0cd4c274 0xffffffff GigabitEthernet0/1SWIDB# 6 0x0bb75704 0xffffffff GigabitEthernet0/1.1PEER IDB# 1 0x0cf8686c 0x00020003 2 GigabitEthernet0/1.1SWIDB# 7 0x0bb75dec 0xffffffff GigabitEthernet0/1.2PEER IDB# 1 0x0d2c08ac 0xffffffff 2 GigabitEthernet0/1.2SWIDB# 8 0x0bb764d4 0xffffffff GigabitEthernet0/1.3PEER IDB# 1 0x0d441294 0x00030001 3 GigabitEthernet0/1.3SWIDB# 9 0x0cd506d4 0x01010002 GigabitEthernet0/2SWIDB# 10 0x0cd54b34 0xffffffff GigabitEthernet0/3PEER IDB# 1 0x0d3291ec 0x00030002 3 GigabitEthernet0/3PEER IDB# 2 0x0d2c0aa4 0x00020001 2 GigabitEthernet0/3PEER IDB# 3 0x0d05a474 0x00010002 1 GigabitEthernet0/3SWIDB# 11 0x0cd58f9c 0xffffffff Management0/0PEER IDB# 1 0x0d05a65c 0x00010003 1 Management0/0Table 7-11 shows each field description.
Related Commands
interface
Configures an interface and enters interface configuration mode.
show interface
Displays the runtime status and statistics of interfaces.
show igmp groups
To display the multicast groups with receivers that are directly connected to the security appliance and that were learned through IGMP, use the show igmp groups command in privileged EXEC mode.
show igmp groups [[reserved | group] [if_name] [detail]] | summary]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
If you omit all optional arguments and keywords, the show igmp groups command displays all directly connected multicast groups by group address, interface type, and interface number.
Examples
The following is sample output from the show igmp groups command:
hostname#show igmp groupsIGMP Connected Group MembershipGroup Address Interface Uptime Expires Last Reporter224.1.1.1 inside 00:00:53 00:03:26 192.168.1.6Related Commands
show igmp interface
To display multicast information for an interface, use the show igmp interface command in privileged EXEC mode.
show igmp interface [if_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
If you omit the optional if_name argument, the show igmp interface command displays information about all interfaces.
Examples
The following is sample output from the show igmp interface command:
hostname# show igmp interface insideinside is up, line protocol is upInternet address is 192.168.37.6, subnet mask is 255.255.255.0IGMP is enabled on interfaceIGMP query interval is 60 secondsInbound IGMP access group is not setMulticast routing is enabled on interfaceMulticast TTL threshold is 0Multicast designated router (DR) is 192.168.37.33No multicast groups joinedRelated Commands
show igmp groups
Displays the multicast groups with receivers that are directly connected to the security appliance and that were learned through IGMP.
show igmp traffic
To display IGMP traffic statistics, use the show igmp traffic command in privileged EXEC mode.
show igmp traffic
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Examples
The following is sample output from the show igmp traffic command:
hostname# show igmp trafficIGMP Traffic CountersElapsed time since counters cleared: 00:02:30Received SentValid IGMP Packets 3 6Queries 2 6Reports 1 0Leaves 0 0Mtrace packets 0 0DVMRP packets 0 0PIM packets 0 0Errors:Malformed Packets 0Martian source 0Bad Checksums 0Related Commands
clear igmp counters
Clears all IGMP statistic counters.
clear igmp traffic
Clear the IGMP traffic counters.
show interface
To view interface statistics, use the show interface command in user EXEC mode.
show interface [physical_interface[.subinterface] | mapped_name | interface_name] [stats | detail]
Syntax Description
Defaults
If you do not identify any options, this command shows basic statistics for all interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
•
•
Command History
Usage Guidelines
If an interface is shared among contexts, and you enter this command within a context, the security appliance shows only statistics for the current context. When you enter this command in the system execution space for a physical interface, the security appliance shows the combined statistics for all contexts.
The number of statistics shown for subinterfaces is a subset of the number of statistics shown for a physical interface.
You cannot use the interface name in the system execution space, because the nameif command is only available within a context. Similarly, if you mapped the interface ID to a mapped name using the allocate-interface command, you can only use the mapped name in a context. If you set the visible keyword in the allocate-interface command, the security appliance shows the interface ID in the output of the show interface command.
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show interface command:
hostname> show interfaceInterface GigabitEthernet0/0 "", is up, line protocol is upHardware is i82546GB rev03, BW 1000 MbpsAuto-Duplex(Half-duplex), Auto-Speed(100 Mbps)Available but not configured via nameifMAC address 000f.f775.540e, MTU not setIP address unassigned752 packets input, 173435 bytes, 0 no bufferReceived 752 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort752 L2 decode drops0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions0 late collisions, 0 deferredinput queue (curr/max blocks): hardware (0/6) software (0/0)output queue (curr/max blocks): hardware (0/0) software (0/0)Interface Management0/0 "intm00", is up, line protocol is upHardware is i82557, BW 100 MbpsAuto-Duplex(Half-duplex), Auto-Speed(100 Mbps)MAC address 000f.f775.5412, MTU 1500IP address unassigned751 packets input, 170487 bytes, 0 no bufferReceived 753 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 L2 decode drops0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred0 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (128/128) software (0/1)output queue (curr/max blocks): hardware (0/0) software (0/0)Received 738 VLAN untagged packets, 156831 bytesTransmitted 0 VLAN untagged packets, 0 bytesDropped 413 VLAN untagged packetsManagement-only interface. Blocked 0 through-the-device packets0 IPv4 packets originated from management network0 IPv4 packets destined to management network0 IPv6 packets originated from management network0 IPv6 packets destined to management networkInterface GigabitEthernet1/0 "intg10", is down, line protocol is downHardware is VCS7380 rev01, BW 1000 MbpsAuto-Duplex, Auto-SpeedMedia-type configured as RJ45 connectorMAC address 000b.fcff.b548, MTU 1500IP address 17.1.9.115, subnet mask 255.0.0.00 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 L2 decode drops0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions0 late collisions, 0 deferred0 rate limit dropsinput queue (curr/max blocks): hardware (0/0) software (0/0)output queue (curr/max blocks): hardware (0/0) software (0/0)Received 0 VLAN untagged packets, 0 bytesTransmitted 0 VLAN untagged packets, 0 bytesDropped 0 VLAN untagged packets...Table 7-11 shows each field description.
The following is sample output from the show interface detail command. The following example shows detailed interface statistics for all interfaces, including the internal interfaces (if present for your platform) and asymmetrical routing statistics, if enabled by the asr-group command:
hostname> show interface detailInterface GigabitEthernet0/0 "", is up, line protocol is upHardware is i82546GB rev03, BW 1000 MbpsAuto-Duplex(Half-duplex), Auto-Speed(100 Mbps)Available but not configured via nameifMAC address 000f.f775.540e, MTU not setIP address unassigned752 packets input, 173435 bytes, 0 no bufferReceived 752 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort752 L2 decode drops0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions0 late collisions, 0 deferredinput queue (curr/max blocks): hardware (0/6) software (0/0)output queue (curr/max blocks): hardware (0/0) software (0/0)Control Point Interface States:Interface number is unassignedInterface Internal-Data0/0 "", is up, line protocol is upHardware is i82547GI rev00, BW 1000 Mbps(Full-duplex), (1000 Mbps)MAC address 0000.0001.0002, MTU not setIP address unassigned6 packets input, 1094 bytes, 0 no bufferReceived 6 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 L2 decode drops, 0 demux drops0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions0 late collisions, 0 deferredinput queue (curr/max blocks): hardware (0/2) software (0/0)output queue (curr/max blocks): hardware (0/0) software (0/0)Control Point Interface States:Interface number is unassignedInterface Management0/0 "intm00", is up, line protocol is upHardware is i82557, BW 100 MbpsAuto-Duplex(Half-duplex), Auto-Speed(100 Mbps)MAC address 000f.f775.5412, MTU 1500IP address unassigned751 packets input, 170487 bytes, 0 no bufferReceived 753 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 L2 decode drops0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred0 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (128/128) software (0/1)output queue (curr/max blocks): hardware (0/0) software (0/0)Received 738 VLAN untagged packets, 156831 bytesTransmitted 0 VLAN untagged packets, 0 bytesDropped 413 VLAN untagged packetsManagement-only interface. Blocked 0 through-the-device packets0 IPv4 packets originated from management network0 IPv4 packets destined to management network0 IPv6 packets originated from management network0 IPv6 packets destined to management networkControl Point Interface States:Interface number is 1Interface config status is activeInterface state is activeInterface GigabitEthernet1/0 "intg10", is down, line protocol is downHardware is VCS7380 rev01, BW 1000 MbpsAuto-Duplex, Auto-SpeedMedia-type configured as RJ45 connectorMAC address 000b.fcff.b548, MTU 1500IP address 17.1.9.115, subnet mask 255.0.0.00 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 L2 decode drops0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions0 late collisions, 0 deferred0 rate limit dropsinput queue (curr/max blocks): hardware (0/0) software (0/0)output queue (curr/max blocks): hardware (0/0) software (0/0)Received 0 VLAN untagged packets, 0 bytesTransmitted 0 VLAN untagged packets, 0 bytesDropped 0 VLAN untagged packetsControl Point Interface States:Interface number is 2Interface config status is activeInterface state is not active...Table 7-16 shows each field description for the show interface detail command. See Table 7-11 for fields that are also shown for the show interface command.
Related Commands
show interface ip brief
To view interface IP addresses and status, use the show interface ip brief command in privileged EXEC mode.
show interface [physical_interface[.subinterface] | mapped_name | interface_name] ip brief
Syntax Description
Defaults
If you do not specify an interface, the security appliance shows all interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
In multiple context mode, if you mapped the interface ID in the allocate-interface command, you can only specify the mapped name or the interface name in a context.
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show ip brief command:
hostname# show interface ip briefInterface IP-Address OK? Method Status ProtocolControl0/0 127.0.1.1 YES CONFIG up upGigabitEthernet0/0 209.165.200.226 YES CONFIG up upGigabitEthernet0/1 unassigned YES unset administratively down downGigabitEthernet0/2 10.1.1.50 YES manual administratively down downGigabitEthernet0/3 192.168.2.6 YES DHCP administratively down downManagement0/0 209.165.201.3 YES CONFIG upTable 7-16 shows each field description.
Related Commands
show inventory
To display information about all of the Cisco products installed in the networking device that are assigned a product identifier (PID), version identifier (VID), and serial number (SN), use the show inventory command in user EXEC or privileged EXEC mode. If a Cisco entity is not assigned a PID, that entity is not retrieved or displayed.
show inventory [slot]
Syntax Description
Defaults
If you do not specify a slot to show inventory for:
•
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
—
•
Command History
Usage Guidelines
The show inventory command retrieves and displays inventory information about each Cisco product in the form of a UDI. The UDI is a combination of three separate data elements: a product identifier (PID), a version identifier (VID), and the serial number (SN).
The PID is the name by which the product can be ordered; it has been historically called the "Product Name" or "Part Number." This is the identifier that one would use to order an exact replacement part.
The VID is the version of the product. Whenever a product has been revised, the VID will be incremented. The VID is incremented according to a rigorous process derived from Telcordia GR-209-CORE, an industry guideline that governs product change notices.
The SN is the vendor-unique serialization of the product. Each manufactured product will carry a unique serial number assigned at the factory, which cannot be changed in the field. This is the means by which to identify an individual, specific instance of a product.
The UDI refers to each product as an entity. Some entities, such as a chassis, will have subentities like slots. Each entity will display on a separate line in a logically ordered presentation that is arranged hierarchically by Cisco entities.
Use the show inventory command without options to display a list of Cisco entities installed in the networking device that are assigned a PID.
Examples
The following is sample output from the show inventory command without any keywords or arguments. This sample output displays a list of Cisco entities installed in a router that are assigned a PID.
ciscoasa# show inventoryName:"Chassis", DESCR:"ASA 5540 Adaptive Security Appliance"PID:ASA5540 , VID:V01 , SN:P3000000998Name:"slot 1", DESCR:"ASA 5500 Series Security Services Module-20"PID:ASA-SSM-20 , VID:V01 , SN:P0000000999Name:"power supply", DESCR:"ASA 5500 Series 180W AC Power Supply"PID:ASA-180W-PWR-AC , VID:V01 , SN:123456789ABciscoasa# show inventory 0Name:"Chassis", DESCR:"ASA 5540 Adaptive Security Appliance"PID:ASA5540 , VID:V01 , SN:P3000000998ciscoasa# show inventory 1Name:"slot 1", DESCR:"ASA 5500 Series Security Services Module-20"PID:ASA-SSM-20 , VID:V01 , SN:P0000000999Table 7-18describes the fields shown in the display.
Related Commands
show ip address
To view interface IP addresses or, for transparent mode, the management IP address, use the show ip address command in privileged EXEC mode.
show ip address [physical_interface[.subinterface] | mapped_name | interface_name]
Syntax Description
Defaults
If you do not specify an interface, the security appliance shows all interface IP addresses.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
This command shows the primary IP addresses (called "System" in the display) for when you configure high availability as well as the current IP addresses. If the unit is active, then the system and current IP addresses match. If the unit is standby, then the current IP addresses show the standby addresses.
Examples
The following is sample output from the show ip address command:
hostname# show ip addressSystem IP Addresses:Interface Name IP address Subnet mask MethodGigabitEthernet0/0 mgmt 10.7.12.100 255.255.255.0 CONFIGGigabitEthernet0/1 inside 10.1.1.100 255.255.255.0 CONFIGGigabitEthernet0/2.40 outside 209.165.201.2 255.255.255.224 DHCPGigabitEthernet0/3 dmz 209.165.200.225 255.255.255.224 manualCurrent IP Addresses:Interface Name IP address Subnet mask MethodGigabitEthernet0/0 mgmt 10.7.12.100 255.255.255.0 CONFIGGigabitEthernet0/1 inside 10.1.1.100 255.255.255.0 CONFIGGigabitEthernet0/2.40 outside 209.165.201.2 255.255.255.224 DHCPGigabitEthernet0/3 dmz 209.165.200.225 255.255.255.224 manualTable 7-16 shows each field description.
Related Commands
show ip address dhcp
To view detailed information about the DHCP lease or server for an interface, use the show ip address dhcp command in privileged EXEC mode.
show ip address {physical_interface[.subinterface] | mapped_name | interface_name} dhcp {lease | server}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
7.0
This command was changed to include the lease and server keywords to accommodate the new server functionality.
Usage Guidelines
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show ip address dhcp lease command:
hostname# show ip address outside dhcp leaseTemp IP Addr:209.165.201.57 for peer on interface:outsideTemp sub net mask:255.255.255.224DHCP Lease server:209.165.200.225, state:3 BoundDHCP Transaction id:0x4123Lease:259200 secs, Renewal:129600 secs, Rebind:226800 secsTemp default-gateway addr:209.165.201.1Temp ip static route0: dest 10.9.0.0 router 10.7.12.255Next timer fires after:111797 secsRetry count:0, Client-ID:cisco-0000.0000.0000-outsideProxy: TRUE Proxy Network: 10.1.1.1Hostname: device1Table 7-16 shows each field description.
The following is sample output from the show ip address dhcp server command:
hostname# show ip address outside dhcp serverDHCP server: ANY (255.255.255.255)Leases: 0Offers: 0 Requests: 0 Acks: 0 Naks: 0Declines: 0 Releases: 0 Bad: 0DHCP server: 40.7.12.6Leases: 1Offers: 1 Requests: 17 Acks: 17 Naks: 0Declines: 0 Releases: 0 Bad: 0DNS0: 171.69.161.23, DNS1: 171.69.161.24WINS0: 172.69.161.23, WINS1: 172.69.161.23Subnet: 255.255.0.0 DNS Domain: cisco.comTable 7-21 shows each field description.
Related Commands
show ip audit count
To show the number of signature matches when you apply an audit policy to an interface, use the show ip audit count command in privileged EXEC mode.
show ip audit count [global | interface interface_name]
Syntax Description
global
(Default) Shows the number of matches for all interfaces.
interface interface_name
(Optional) Shows the number of matches for the specified interface.
Defaults
If you do not specify a keyword, this command shows the matches for all interfaces (global).
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
To create an audit policy, use the ip audit name command, and to apply the policy, use the ip audit interface command.
Examples
The following is sample output from the show ip audit count command:
hostname# show ip audit countIP AUDIT GLOBAL COUNTERS1000 I Bad IP Options List 01001 I Record Packet Route 01002 I Timestamp 01003 I Provide s,c,h,tcc 01004 I Loose Source Route 01005 I SATNET ID 01006 I Strict Source Route 01100 A IP Fragment Attack 01102 A Impossible IP Packet 01103 A IP Teardrop 02000 I ICMP Echo Reply 02001 I ICMP Unreachable 02002 I ICMP Source Quench 02003 I ICMP Redirect 02004 I ICMP Echo Request 102005 I ICMP Time Exceed 02006 I ICMP Parameter Problem 02007 I ICMP Time Request 02008 I ICMP Time Reply 02009 I ICMP Info Request 02010 I ICMP Info Reply 02011 I ICMP Address Mask Request 02012 I ICMP Address Mask Reply 02150 A Fragmented ICMP 02151 A Large ICMP 02154 A Ping of Death 03040 A TCP No Flags 03041 A TCP SYN & FIN Flags Only 03042 A TCP FIN Flag Only 03153 A FTP Improper Address 03154 A FTP Improper Port 04050 A Bomb 04051 A Snork 04052 A Chargen 06050 A DNS Host Info 06051 A DNS Zone Xfer 06052 A DNS Zone Xfer High Port 06053 A DNS All Records 06100 I RPC Port Registration 06101 I RPC Port Unregistration 06102 I RPC Dump 06103 A Proxied RPC 06150 I ypserv Portmap Request 06151 I ypbind Portmap Request 06152 I yppasswdd Portmap Request 06153 I ypupdated Portmap Request 06154 I ypxfrd Portmap Request 06155 I mountd Portmap Request 06175 I rexd Portmap Request 06180 I rexd Attempt 06190 A statd Buffer Overflow 0IP AUDIT INTERFACE COUNTERS: inside...Related Commands
show ip verify statistics
To show the number of packets dropped because of the Unicast RPF feature, use the show ip verify statistics command in privileged EXEC mode. Use the ip verify reverse-path command to enable Unicast RPF.
show ip verify statistics [interface interface_name]
Syntax Description
Defaults
This command shows statistics for all interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Examples
The following is sample output from the show ip verify statistics command:
hostname# show ip verify statisticsinterface outside: 2 unicast rpf dropsinterface inside: 1 unicast rpf dropsinterface intf2: 3 unicast rpf dropsRelated Commands
show ipsec sa
To display a list of IPSec SAs, use the show ipsec sa command in global configuration mode or privileged EXEC mode. You can also use the alternate form of this command: show crypto ipsec sa.
show ipsec sa [entry | identity | map map-name | peer peer-addr ] [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following example, entered in global configuration mode, displays IPSec SAs.
hostname(config)# show ipsec sainterface: outside2Crypto map tag: def, local addr: 10.132.0.17local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (172.20.0.21/255.255.255.255/0/0)current_peer: 172.20.0.21dynamic allocated peer ip: 10.135.1.5#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0#pkts decaps: 1145, #pkts decrypt: 1145, #pkts verify: 1145#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0#send errors: 0, #recv errors: 0local crypto endpt.: 10.132.0.17, remote crypto endpt.: 172.20.0.21path mtu 1500, ipsec overhead 60, media mtu 1500current outbound spi: DC15BF68inbound esp sas:spi: 0x1E8246FC (511854332)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 3, crypto-map: defsa timing: remaining key lifetime (sec): 548IV size: 8 bytesreplay detection support: Youtbound esp sas:spi: 0xDC15BF68 (3692412776)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 3, crypto-map: defsa timing: remaining key lifetime (sec): 548IV size: 8 bytesreplay detection support: YCrypto map tag: def, local addr: 10.132.0.17local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)hostname(config)#The following example, entered in global configuration mode, displays IPSec SAs for a crypto map named def.
hostname(config)# show ipsec sa map defcryptomap: defCrypto map tag: def, local addr: 172.20.0.17local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (10.132.0.21/255.255.255.255/0/0)current_peer: 10.132.0.21dynamic allocated peer ip: 90.135.1.5#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0#pkts decaps: 1146, #pkts decrypt: 1146, #pkts verify: 1146#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0#send errors: 0, #recv errors: 0local crypto endpt.: 172.20.0.17, remote crypto endpt.: 10.132.0.21path mtu 1500, ipsec overhead 60, media mtu 1500current outbound spi: DC15BF68inbound esp sas:spi: 0x1E8246FC (511854332)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 3, crypto-map: defsa timing: remaining key lifetime (sec): 480IV size: 8 bytesreplay detection support: Youtbound esp sas:spi: 0xDC15BF68 (3692412776)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 3, crypto-map: defsa timing: remaining key lifetime (sec): 480IV size: 8 bytesreplay detection support: YCrypto map tag: def, local addr: 172.20.0.17local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (192.168.132.0/255.255.255.0/0/0)current_peer: 10.135.1.8dynamic allocated peer ip: 0.0.0.0#pkts encaps: 73672, #pkts encrypt: 73672, #pkts digest: 73672#pkts decaps: 78824, #pkts decrypt: 78824, #pkts verify: 78824#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 73672, #pkts comp failed: 0, #pkts decomp failed: 0#send errors: 0, #recv errors: 0local crypto endpt.: 172.20.0.17, remote crypto endpt.: 10.135.1.8path mtu 1500, ipsec overhead 60, media mtu 1500current outbound spi: 3B6F6A35inbound esp sas:spi: 0xB32CF0BD (3006066877)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 4, crypto-map: defsa timing: remaining key lifetime (sec): 263IV size: 8 bytesreplay detection support: Youtbound esp sas:spi: 0x3B6F6A35 (997157429)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 4, crypto-map: defsa timing: remaining key lifetime (sec): 263IV size: 8 bytesreplay detection support: Yhostname(config)#The following example, entered in global configuration mode, shows IPSec SAs for the keyword entry.
hostname(config)# show ipsec sa entrypeer address: 10.132.0.21Crypto map tag: def, local addr: 172.20.0.17local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (10.132.0.21/255.255.255.255/0/0)current_peer: 10.132.0.21dynamic allocated peer ip: 90.135.1.5#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0#pkts decaps: 1147, #pkts decrypt: 1147, #pkts verify: 1147#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0#send errors: 0, #recv errors: 0local crypto endpt.: 172.20.0.17, remote crypto endpt.: 10.132.0.21path mtu 1500, ipsec overhead 60, media mtu 1500current outbound spi: DC15BF68inbound esp sas:spi: 0x1E8246FC (511854332)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 3, crypto-map: defsa timing: remaining key lifetime (sec): 429IV size: 8 bytesreplay detection support: Youtbound esp sas:spi: 0xDC15BF68 (3692412776)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 3, crypto-map: defsa timing: remaining key lifetime (sec): 429IV size: 8 bytesreplay detection support: Ypeer address: 10.135.1.8Crypto map tag: def, local addr: 172.20.0.17local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (192.168.132.0/255.255.255.0/0/0)current_peer: 10.135.1.8dynamic allocated peer ip: 0.0.0.0#pkts encaps: 73723, #pkts encrypt: 73723, #pkts digest: 73723#pkts decaps: 78878, #pkts decrypt: 78878, #pkts verify: 78878#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 73723, #pkts comp failed: 0, #pkts decomp failed: 0#send errors: 0, #recv errors: 0local crypto endpt.: 172.20.0.17, remote crypto endpt.: 10.135.1.8path mtu 1500, ipsec overhead 60, media mtu 1500current outbound spi: 3B6F6A35inbound esp sas:spi: 0xB32CF0BD (3006066877)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 4, crypto-map: defsa timing: remaining key lifetime (sec): 212IV size: 8 bytesreplay detection support: Youtbound esp sas:spi: 0x3B6F6A35 (997157429)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 4, crypto-map: defsa timing: remaining key lifetime (sec): 212IV size: 8 bytesreplay detection support: Yhostname(config)#The following example, entered in global configuration mode, shows IPSec SAs with the keywords entry detail.
hostname(config)# show ipsec sa entry detailpeer address: 10.132.0.21Crypto map tag: def, local addr: 172.20.0.17local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (10.132.0.21/255.255.255.255/0/0)current_peer: 10.132.0.21dynamic allocated peer ip: 90.135.1.5#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0#pkts decaps: 1148, #pkts decrypt: 1148, #pkts verify: 1148#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0#pkts no sa (send): 0, #pkts invalid sa (rcv): 0#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0#pkts invalid prot (rcv): 0, #pkts verify failed: 0#pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0#pkts replay failed (rcv): 0#pkts internal err (send): 0, #pkts internal err (rcv): 0local crypto endpt.: 172.20.0.17, remote crypto endpt.: 10.132.0.21path mtu 1500, ipsec overhead 60, media mtu 1500current outbound spi: DC15BF68inbound esp sas:spi: 0x1E8246FC (511854332)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 3, crypto-map: defsa timing: remaining key lifetime (sec): 322IV size: 8 bytesreplay detection support: Youtbound esp sas:spi: 0xDC15BF68 (3692412776)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 3, crypto-map: defsa timing: remaining key lifetime (sec): 322IV size: 8 bytesreplay detection support: Ypeer address: 10.135.1.8Crypto map tag: def, local addr: 172.20.0.17local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (192.168.132.0/255.255.255.0/0/0)current_peer: 10.135.1.8dynamic allocated peer ip: 0.0.0.0#pkts encaps: 73831, #pkts encrypt: 73831, #pkts digest: 73831#pkts decaps: 78989, #pkts decrypt: 78989, #pkts verify: 78989#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 73831, #pkts comp failed: 0, #pkts decomp failed: 0#pkts no sa (send): 0, #pkts invalid sa (rcv): 0#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0#pkts invalid prot (rcv): 0, #pkts verify failed: 0#pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0#pkts replay failed (rcv): 0#pkts internal err (send): 0, #pkts internal err (rcv): 0local crypto endpt.: 172.20.0.17, remote crypto endpt.: 10.135.1.8path mtu 1500, ipsec overhead 60, media mtu 1500current outbound spi: 3B6F6A35inbound esp sas:spi: 0xB32CF0BD (3006066877)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 4, crypto-map: defsa timing: remaining key lifetime (sec): 104IV size: 8 bytesreplay detection support: Youtbound esp sas:spi: 0x3B6F6A35 (997157429)transform: esp-3des esp-md5-hmacin use settings ={RA, Tunnel, }slot: 0, conn_id: 4, crypto-map: defsa timing: remaining key lifetime (sec): 104IV size: 8 bytesreplay detection support: Yhostname(config)#The following example shows IPSec SAs with the keyword identity.
hostname(config)# show ipsec sa identityinterface: outside2Crypto map tag: def, local addr: 172.20.0.17local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (10.132.0.21/255.255.255.255/0/0)current_peer: 10.132.0.21dynamic allocated peer ip: 90.135.1.5#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0#pkts decaps: 1147, #pkts decrypt: 1147, #pkts verify: 1147#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0#send errors: 0, #recv errors: 0local crypto endpt.: 172.20.0.17, remote crypto endpt.: 10.132.0.21path mtu 1500, ipsec overhead 60, media mtu 1500current outbound spi: DC15BF68Crypto map tag: def, local addr: 172.20.0.17local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (192.168.132.0/255.255.255.0/0/0)current_peer: 10.135.1.8dynamic allocated peer ip: 0.0.0.0#pkts encaps: 73756, #pkts encrypt: 73756, #pkts digest: 73756#pkts decaps: 78911, #pkts decrypt: 78911, #pkts verify: 78911#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 73756, #pkts comp failed: 0, #pkts decomp failed: 0#send errors: 0, #recv errors: 0local crypto endpt.: 172.20.0.17, remote crypto endpt.: 10.135.1.8path mtu 1500, ipsec overhead 60, media mtu 1500current outbound spi: 3B6F6A35The following example shows IPSec SAs with the keywords identity and detail.
hostname(config)# show ipsec sa identity detailinterface: outside2Crypto map tag: def, local addr: 172.20.0.17local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (10.132.0.21/255.255.255.255/0/0)current_peer: 10.132.0.21dynamic allocated peer ip: 90.135.1.5#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0#pkts decaps: 1147, #pkts decrypt: 1147, #pkts verify: 1147#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0#pkts no sa (send): 0, #pkts invalid sa (rcv): 0#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0#pkts invalid prot (rcv): 0, #pkts verify failed: 0#pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0#pkts replay failed (rcv): 0#pkts internal err (send): 0, #pkts internal err (rcv): 0local crypto endpt.: 172.20.0.17, remote crypto endpt.: 10.132.0.21path mtu 1500, ipsec overhead 60, media mtu 1500current outbound spi: DC15BF68Crypto map tag: def, local addr: 172.20.0.17local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (192.168.132.0/255.255.255.0/0/0)current_peer: 10.135.1.8dynamic allocated peer ip: 0.0.0.0#pkts encaps: 73771, #pkts encrypt: 73771, #pkts digest: 73771#pkts decaps: 78926, #pkts decrypt: 78926, #pkts verify: 78926#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 73771, #pkts comp failed: 0, #pkts decomp failed: 0#pkts no sa (send): 0, #pkts invalid sa (rcv): 0#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0#pkts invalid prot (rcv): 0, #pkts verify failed: 0#pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0#pkts replay failed (rcv): 0#pkts internal err (send): 0, #pkts internal err (rcv): 0local crypto endpt.: 172.20.0.17, remote crypto endpt.: 10.135.1.8path mtu 1500, ipsec overhead 60, media mtu 1500current outbound spi: 3B6F6A35Related Commands
show ipsec sa summary
To display a summary of IPSec SAs, use the show ipsec sa summary command in global configuration mode or privileged EXEC mode.
show ipsec sa summary
Syntax Description
This command has no arguments or variables.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following example, entered in global configuration mode, displays a summary of IPSec SAs by the following connection types:
•
•
•
•
•
hostname(config)# show ipsec sa summaryCurrent IPSec SA's: Peak IPSec SA's:IPSec : 2 Peak Concurrent SA : 14IPSec over UDP : 2 Peak Concurrent L2L : 0IPSec over NAT-T : 4 Peak Concurrent RA : 14IPSec over TCP : 6IPSec VPN LB : 0Total : 14hostname(config)#Related Commands
clear ipsec sa
Removes IPSec SAs entirely or based on specific parameters.
show ipsec sa
Displays a list of IPSec SAs.
show ipsec stats
Displays a list of IPSec statistics.
show ipsec stats
To display a list of IPSec statistics, use the show ipsec stats command in global configuration mode or privileged EXEC mode.
show ipsec stats
Syntax Description
This command has no keywords or variables.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following example, entered in global configuration mode, displays IPSec statistics:
hostname(config)# show ipsec statsIPsec Global Statistics-----------------------Active tunnels: 2Previous tunnels: 9InboundBytes: 4933013Decompressed bytes: 4933013Packets: 80348Dropped packets: 0Replay failures: 0Authentications: 80348Authentication failures: 0Decryptions: 80348Decryption failures: 0OutboundBytes: 4441740Uncompressed bytes: 4441740Packets: 74029Dropped packets: 0Authentications: 74029Authentication failures: 0Encryptions: 74029Encryption failures: 0Protocol failures: 0Missing SA failures: 0System capacity failures: 0hostname(config)#Related Commands
show ipv6 access-list
To display the IPv6 access list, use the show ipv6 access-list command in privileged EXEC mode. The IPv6 access list determines what IPv6 traffic can pass through the security appliance.
show ipv6 access-list [id [source-ipv6-prefix/prefix-length | any | host source-ipv6-address]]
Syntax Description
Defaults
Displays all IPv6 access lists.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
The show ipv6 access-list command provides output similar to the show ip access-list command, except that it is IPv6-specific.
Examples
The following is sample output from the show ipv6 access-list command. It shows IPv6 access lists named inbound, tcptraffic, and outbound.
hostname# show ipv6 access-listIPv6 access list inboundpermit tcp any any eq bgp reflect tcptraffic (8 matches) sequence 10permit tcp any any eq telnet reflect tcptraffic (15 matches) sequence 20permit udp any any reflect udptraffic sequence 30IPv6 access list tcptraffic (reflexive) (per-user)permit tcp host 2001:0DB8:1::1 eq bgp host 2001:0DB8:1::2 eq 11000 timeout 300 (timeleft 243) sequence 1permit tcp host 2001:0DB8:1::1 eq telnet host 2001:0DB8:1::2 eq 11001 timeout 300(time left 296) sequence 2IPv6 access list outboundevaluate udptrafficevaluate tcptrafficRelated Commands
show ipv6 interface
To display the status of interfaces configured for IPv6, use the show ipv6 interface command in privileged EXEC mode.
show ipv6 interface [brief] [if_name [prefix]]
Syntax Description
Defaults
Displays all IPv6 interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
The show ipv6 interface command provides output similar to the show interface command, except that it is IPv6-specific. If the interface hardware is usable, the interface is marked up. If the interface can provide two-way communication, the line protocol is marked up.
When an interface name is not specified, information on all IPv6 interfaces is displayed. Specifying an interface name displays information about the specified interface.
Examples
The following is sample output from the show ipv6 interface command:
hostname# show ipv6 interface outsideinterface ethernet0 "outside" is up, line protocol is upIPv6 is enabled, link-local address is 2001:0DB8::/29 [TENTATIVE]Global unicast address(es):2000::2, subnet is 2000::/64Joined group address(es):FF02::1FF02::1:FF11:6770MTU is 1500 bytesND DAD is enabled, number of DAD attempts: 1ND reachable time is 30000 millisecondsND advertised reachable time is 0 millisecondsND advertised retransmit interval is 0 millisecondsND router advertisements are sent every 200 secondsND router advertisements live for 1800 secondsThe following is sample output from the show ipv6 interface command when entered with the brief keyword:
hostname# show ipv6 interface briefoutside [up/up]unassignedinside [up/up]fe80::20d:29ff:fe1d:69f0fec0::a:0:0:a0a:a70vlan101 [up/up]fe80::20d:29ff:fe1d:69f0fec0::65:0:0:a0a:6570dmz-ca [up/up]unassignedThe following is sample output from the show ipv6 interface command. It shows the characteristics of an interface which has generated a prefix from an address.
hostname# show ipv6 interface inside prefixIPv6 Prefix Advertisements insideCodes: A - Address, P - Prefix-Advertisement, O - PoolU - Per-user prefix, D - Default N - Not advertised, C - CalendarAD fec0:0:0:a::/64 [LA] Valid lifetime 2592000, preferred lifetime 604800
show ipv6 neighbor
To display the IPv6 neighbor discovery cache information, use the show ipv6 neighbor command in privileged EXEC mode.
show ipv6 neighbor [if_name | address]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
The following information is provided by the show ipv6 neighbor command:
•
•
•
•
Note
The following are possible states for dynamic entries in the IPv6 neighbor discovery cache:
–
–
–
–
–
–
The following are possible states for static entries in the IPv6 neighbor discovery cache:
–
–
· InterfaceInterface from which the address was reachable.Examples
The following is sample output from the show ipv6 neighbor command when entered with an interface:
hostname# show ipv6 neighbor insideIPv6 Address Age Link-layer Addr State Interface2000:0:0:4::2 0 0003.a0d6.141e REACH insideFE80::203:A0FF:FED6:141E 0 0003.a0d6.141e REACH inside3001:1::45a - 0002.7d1a.9472 REACH insideThe following is sample output from the show ipv6 neighbor command when entered with an IPv6 address:
hostname# show ipv6 neighbor 2000:0:0:4::2IPv6 Address Age Link-layer Addr State Interface2000:0:0:4::2 0 0003.a0d6.141e REACH insideRelated Commands
clear ipv6 neighbors
Deletes all entries in the IPv6 neighbor discovery cache, except static entries.
ipv6 neighbor
Configures a static entry in the IPv6 neighbor discovery cache.
show ipv6 route
To display the contents of the IPv6 routing table, use the show ipv6 route command in privileged EXEC mode.
show ipv6 route
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
•
–
–
–
–
–
–
–
–
•
•
•
•
Examples
The following is sample output from the show ipv6 route command:
hostname# show ipv6 routeIPv6 Routing Table - 7 entriesCodes: C - Connected, L - Local, S - Static, R - RIP, B - BGPU - Per-user Static routeI1 - ISIS L1, I2 - ISIS L2, IA - ISIS interareaO - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2L fe80::/10 [0/0]via ::, insidevia ::, vlan101L fec0::a:0:0:a0a:a70/128 [0/0]via ::, insideC fec0:0:0:a::/64 [0/0]via ::, insideL fec0::65:0:0:a0a:6570/128 [0/0]via ::, vlan101C fec0:0:0:65::/64 [0/0]via ::, vlan101L ff00::/8 [0/0]via ::, insidevia ::, vlan101S ::/0 [0/0]via fec0::65:0:0:a0a:6575, vlan101Related Commands
debug ipv6 route
Displays debug messages for IPv6 routing table updates and route cache updates.
ipv6 route
Adds a static entry to the IPv6 routing table.
show ipv6 routers
To display IPv6 router advertisement information received from on-link routers, use the show ipv6 routers command in privileged EXEC mode.
show ipv6 routers [if_name]
Syntax Description
if_name
(Optional) The internal or external interface name, as designated by the nameif command, that you want to display information about.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
When an interface name is not specified, information on all IPv6 interfaces is displayed. Specifying an interface name displays information about the specified interface.
Examples
The following is sample output from the show ipv6 routers command when entered without an interface name:
hostname# show ipv6 routersRouter FE80::83B3:60A4 on outside, last update 3 minHops 0, Lifetime 6000 sec, AddrFlag=0, OtherFlag=0Reachable time 0 msec, Retransmit time 0 msecPrefix 3FFE:C00:8007::800:207C:4E37/96 autoconfigValid lifetime -1, preferred lifetime -1Router FE80::290:27FF:FE8C:B709 on inside, last update 0 minHops 64, Lifetime 1800 sec, AddrFlag=0, OtherFlag=0Reachable time 0 msec, Retransmit time 0 msecRelated Commands
show ipv6 traffic
To display statistics about IPv6 traffic, use the show ipv6 traffic command in privileged EXEC mode.
show ipv6 traffic
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
Use the clear ipv6 traffic command to clear the traffic counters.
Examples
The following is sample output from the show ipv6 traffic command:
hostname# show ipv6 trafficIPv6 statistics:Rcvd: 545 total, 545 local destination0 source-routed, 0 truncated0 format errors, 0 hop count exceeded0 bad header, 0 unknown option, 0 bad source0 unknown protocol, 0 not a router218 fragments, 109 total reassembled0 reassembly timeouts, 0 reassembly failuresSent: 228 generated, 0 forwarded1 fragmented into 2 fragments, 0 failed0 encapsulation failed, 0 no route, 0 too bigMcast: 168 received, 70 sentICMP statistics:Rcvd: 116 input, 0 checksum errors, 0 too short0 unknown info type, 0 unknown error typeunreach: 0 routing, 0 admin, 0 neighbor, 0 address, 0 portparameter: 0 error, 0 header, 0 option0 hopcount expired, 0 reassembly timeout,0 too big0 echo request, 0 echo reply0 group query, 0 group report, 0 group reduce0 router solicit, 60 router advert, 0 redirects31 neighbor solicit, 25 neighbor advertSent: 85 output, 0 rate-limitedunreach: 0 routing, 0 admin, 0 neighbor, 0 address, 0 portparameter: 0 error, 0 header, 0 option0 hopcount expired, 0 reassembly timeout,0 too big0 echo request, 0 echo reply0 group query, 0 group report, 0 group reduce0 router solicit, 18 router advert, 0 redirects33 neighbor solicit, 34 neighbor advertUDP statistics:Rcvd: 109 input, 0 checksum errors, 0 length errors0 no port, 0 droppedSent: 37 outputTCP statistics:Rcvd: 85 input, 0 checksum errorsSent: 103 output, 0 retransmittedRelated Commands
show isakmp sa
To display the IKE runtime SA database, use the show isakmp sa command in global configuration mode or privileged EXEC mode.
show isakmp sa [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Usage Guidelines
The output from this command includes the following fields:
Detail not specified.
Table 7-25
IKE Peer
Type
Dir
Rky
State
Encrypt
Hash
Auth
Lifetime
209.165.200.225
L2L
Init
No
MM_Active
3des
md5
preshrd
86400
Detail specified.
Examples
The following example, entered in global configuration mode, displays detailed information about the SA database:
hostname(config)# show isakmp sa detailhostname(config)# sho isakmp sa detailIKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime1 209.165.200.225 User Resp No AM_Active 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime2 209.165.200.226 User Resp No AM_ACTIVE 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime3 209.165.200.227 User Resp No AM_ACTIVE 3des SHA preshrd 86400IKE Peer Type Dir Rky State Encrypt Hash Auth Lifetime4 209.165.200.228 User Resp No AM_ACTIVE 3des SHA preshrd 86400hostname(config)#Related Commands
show isakmp stats
To display runtime statistics, use the show isakmp stats command in global configuration mode or privileged EXEC mode.
show isakmp stats
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Usage Guidelines
The output from this command includes the following fields:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following example, issued in global configuration mode, displays ISAKMP statistics:
hostname(config)# show isakmp statsGlobal IKE StatisticsActive Tunnels: 132Previous Tunnels: 132In Octets: 195471In Packets: 1854In Drop Packets: 925In Notifys: 0In P2 Exchanges: 132In P2 Exchange Invalids: 0In P2 Exchange Rejects: 0In P2 Sa Delete Requests: 0Out Octets: 119029Out Packets: 796Out Drop Packets: 0Out Notifys: 264Out P2 Exchanges: 0Out P2 Exchange Invalids: 0Out P2 Exchange Rejects: 0Out P2 Sa Delete Requests: 0Initiator Tunnels: 0Initiator Fails: 0Responder Fails: 0System Capacity Fails: 0Auth Fails: 0Decrypt Fails: 0Hash Valid Fails: 0No Sa Fails: 0hostname(config)#Related Commands
show local-host
To display the network states of local hosts, use the show local-host command in privileged EXEC mode.
show local-host [ip_address] [detail] [all][brief] [connection {tcp <start>[-<end>] | udp <start>[-<end>] | embryonic <start>[-<end>]}]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Preexisting
This command was preexisting.
7.0(8)
Added the connection and brief options.
Usage Guidelines
The show local-host command lets you display the network states of local hosts. A local-host is created for any host that forwards traffic to, or through, the security appliance.
This command lets you show the translation and connection slots for the local hosts or stop all traffic on these hosts. This command provides information for hosts that are configured with the nat 0 access-list command when normal translation and connection states may not apply.
The show local-host detail command displays more information about active xlates and network connections.
Use the ip_address argument to limit the display to a single host.
Use the all keyword to list local hosts-made connections, including to the security appliance and from the security appliance. If you do not use the all keyword, local hosts connections to the security appliance and from the appliance do not display.
This command displays the connection limit values. If a connection limit is not set, the value displays as 0 and the limit is not applied.
In the event of a syn attack (with TCP intercept configured), the show local-host command output includes the number of intercepted connections in the usage count. This field typically displays only full open connections.
In the show local-host command output, the TCP embryonic count to host counter is used when a maximum embryonic limit (TCP intercept watermark) is configured for a host using a static connection. This counter shows the total embryonic connections to the host from other hosts. If this total exceeds the maximum configured limit, TCP intercept is applied to new connections to the host.
Examples
The following examples show how to display the network states of local hosts:
hostname# show local-host allInterface outside: 1 active, 2 maximum active, 0 deniedlocal host: <11.0.0.4>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 11.0.0.4 in 11.0.0.3 idle 0:01:42 bytes 4464105 out 11.0.0.4 in 11.0.0.3 idle 0:01:44 bytes 4464Interface inside: 1 active, 2 maximum active, 0 deniedlocal host: <17.3.8.2>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 17.3.8.2 in 17.3.8.1 idle 0:01:42 bytes 4464105 out 17.3.8.2 in 17.3.8.1 idle 0:01:44 bytes 4464Interface NP Identity Ifc: 2 active, 4 maximum active, 0 deniedlocal host: <11.0.0.3>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 11.0.0.4 in 11.0.0.3 idle 0:01:44 bytes 4464105 out 11.0.0.4 in 11.0.0.3 idle 0:01:42 bytes 4464local host: <17.3.8.1>,TCP flow count/limit = 0/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedConn:105 out 17.3.8.2 in 17.3.8.1 idle 0:01:44 bytes 4464105 out 17.3.8.2 in 17.3.8.1 idle 0:01:42 bytes 4464hostname# show local-host 10.1.1.91Interface third: 0 active, 0 maximum active, 0 deniedInterface inside: 1 active, 1 maximum active, 0 deniedlocal host: <10.1.1.91>,TCP flow count/limit = 1/unlimitedTCP embryonic count to (from) host = 0 (0)TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedXlate:PAT Global 192.150.49.1(1024) Local 10.1.1.91(4984)Conn:TCP out 192.150.49.10:21 in 10.1.1.91:4984 idle 0:00:07 bytes 75 flags UI Interfaceoutside: 1 active, 1 maximum active, 0 deniedhostname# show local-host 10.1.1.91 detailInterface third: 0 active, 0 maximum active, 0 deniedInterface inside: 1 active, 1 maximum active, 0 deniedlocal host: <10.1.1.91>,TCP flow count/limit = 1/unlimitedTCP embryonic count to (from) host = 0 (0)TCP intercept watermark = unlimitedUDP flow count/limit = 0/unlimitedXlate:TCP PAT from inside:10.1.1.91/4984 to outside:192.150.49.1/1024 flags riConn:TCP outside:192.150.49.10/21 inside:10.1.1.91/4984 flags UI Interface outside: 1 active, 1 maximum active, 0 deniedThe following example shows all hosts who have at least four udp connections and have between one to 10 tcp connections at the same time:hostname# show local-host connection udp 4 tcp 1-10Interface mng: 0 active, 3 maximum active, 0 deniedInterface INSIDE: 4 active, 5 maximum active, 0 deniedlocal host: <10.1.1.11>,TCP flow count/limit = 1/unlimited TCP embryonic count to host = 0 TCP intercept watermark = unlimited UDP flow count/limit = 4/unlimitedXlate:Global 192.168.1.24 Local 10.1.1.11 Conn: UDP out 192.168.1.10:80 in 10.1.1.11:1730 idle 0:00:21 bytes 0 flags - UDP out 192.168.1.10:80 in 10.1.1.11:1729 idle 0:00:22 bytes 0 flags - UDP out 192.168.1.10:80 in 10.1.1.11:1728 idle 0:00:23 bytes 0 flags - UDP out 192.168.1.10:80 in 10.1.1.11:1727 idle 0:00:24 bytes 0 flags - TCP out 192.168.1.10:22 in 10.1.1.11:27337 idle 0:01:55 bytes 2641 flags UIO Interface OUTSIDE: 3 active, 5 maximum active, 0 deniedThe following example shows local-host addresses and connection counters using the brief option:
hostname# show local-host connection udp 2Interface mng: 0 active, 3 maximum active, 0 deniedInterface INSIDE: 4 active, 5 maximum active, 0 deniedlocal host: <10.1.1.11>,TCP flow count/limit = 1/unlimitedTCP embryonic count to host = 0TCP intercept watermark = unlimited UDP flow count/limit = 4/unlimitedInterface OUTSIDE: 3 active, 5 maximum active, 0 deniedThe following examples shows the output when using the brief and connection syntax:
hostname#show local-host briefInterface inside: 1 active, 1 maximum active, 0 deniedInterface outside: 1 active, 1 maximum active, 0 deniedInterface mgmt: 5 active, 6 maximum active, 0 deniedhostname# show local-host connectionInterface inside: 1 active, 1 maximum active, 0 deniedInterface outside: 1 active, 1 maximum active, 0 deniedInterface mgmt: 5 active, 6 maximum active, 0 deniedRelated Commands
clear local-host
Releases network connections from local hosts displayed by the show local-host command.
nat
Associates a network with a pool of global IP addresses.
show logging
To show the logs in the buffer or to show other logging settings, use the show logging command.
show logging [message [syslog_id | all] | asdm | queue | setting]
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
If the logging buffered command is in use, the show logging command without any keywords shows the current message buffer and the current settings.
The show logging queue command allows you to display the following:
•
•
•
Examples
The following is sample output from the show logging command:
hostname(config)# show loggingSyslog logging: enabledTimestamp logging: disabledConsole logging: disabledMonitor logging: disabledBuffer logging: level debugging, 37 messages loggedTrap logging: disabled305001: Portmapped translation built for gaddr 209.165.201.5/0 laddr 192.168.1.2/256...The following is sample output from the show logging message all command:
hostname(config)# show logging message allsyslog 111111: default-level alerts (enabled)syslog 101001: default-level alerts (enabled)syslog 101002: default-level alerts (enabled)syslog 101003: default-level alerts (enabled)syslog 101004: default-level alerts (enabled)syslog 101005: default-level alerts (enabled)syslog 102001: default-level alerts (enabled)syslog 103001: default-level alerts (enabled)syslog 103002: default-level alerts (enabled)syslog 103003: default-level alerts (enabled)syslog 103004: default-level alerts (enabled)syslog 103005: default-level alerts (enabled)syslog 103011: default-level alerts (enabled)syslog 103012: default-level informational (enabled)Related Commands
show logging rate-limit
To display the disallowed messages to the original set, use the show logging rate-limit command.
show logging rate-limit
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
After the information is cleared, nothing more displays until the hosts reestablish their connections.
Examples
This example shows how to display the disallowed messages:
hostname(config)# show logging rate-limitRelated Commands
show mac-address-table
To show the MAC address table, use the show mac-address-table command in privileged EXEC mode.
show mac-address-table [interface_name | count | static]
Syntax Description
Defaults
If you do not specify an interface, all interface MAC address entries are shown.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
—
Command History
Examples
The following is sample output from the show mac-address-table command:
hostname# show mac-address-tableinterface mac address type Time Left-----------------------------------------------------------------------outside 0009.7cbe.2100 static -inside 0010.7cbe.6101 static -inside 0009.7cbe.5101 dynamic 10The following is sample output from the show mac-address-table command for the inside interface:
hostname# show mac-address-table insideinterface mac address type Time Left-----------------------------------------------------------------------inside 0010.7cbe.6101 static -inside 0009.7cbe.5101 dynamic 10The following is sample output from the show mac-address-table count command:
hostname# show mac-address-table countStatic mac-address bridges (curr/max): 0/65535Dynamic mac-address bridges (curr/max): 103/65535Related Commands
show management-access
To display the name of the internal interface configured for management access, use the show management-access command in privileged EXEC mode.
show management-access
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The management-access command lets you define an internal management interface using the IP address of the firewall interface specified in mgmt_if. (The interface names are defined by the nameif command and displayed in quotes, " ", in the output of the show interface command.)
Examples
The following example shows how to configure a firewall interface named "inside" as the management access interface and display the result:
hostname(config)# management-access insidehostname(config)# show management-accessmanagement-access insideRelated Commands
show memory
To display a summary of the maximum physical memory and current free memory available to the operating system, use the show memory command in privileged EXEC mode.
show memory [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Usage Guidelines
The show memory command lets you display a summary of the maximum physical memory and current free memory available to the operating system. Memory is allocated as needed.
You can use the show memory detail output with show memory binsize command to debug memory leaks.
You can also display the information from the show memory command using SNMP.
Examples
This example shows how to display a summary of the maximum physical memory and current free memory available:
hostname# show memoryFree memory: 845044716 bytes (79%)Used memory: 228697108 bytes (21%)------------- ----------------Total memory: 1073741824 bytes (100%)This example shows detailed memory output:
hostname# show memory detail Free memory: 15958088 bytes (24%) Used memory: Allocated memory in use: 29680332 bytes (44%) Reserved memory: 21470444 bytes (32%) ----------------------------- ---------------- Total memory: 67108864 bytes (100%) Least free memory: 4551716 bytes ( 7%) Most used memory: 62557148 bytes (93%) ----- fragmented memory statistics ----- fragment size count total (bytes) (bytes) ---------------- ---------- -------------- 16 8 128 24 4 96 32 2 64 40 5 200 64 3 192 88 1 88 168 1 168 224 1 224 256 1 256 296 2 592 392 1 392 400 1 400 1816 1 1816* 4435968 1 4435968** 11517504 1 11517504 * - top most releasable chunk. ** - contiguous memory on top of heap. ----- allocated memory statistics ----- fragment size count total (bytes) (bytes) ---------------- ---------- -------------- 40 50 2000 48 144 6912 56 24957 1397592 64 101 6464 72 99 7128 80 1032 82560 88 18 1584 96 64 6144 104 57 5928 112 6 672 120 112 13440 128 15 1920 136 87 11832 144 22 3168152 31 4712 160 90 14400 168 65 10920 176 74 13024 184 11 2024 192 8 1536 200 1 200 <output omitted>Related Commands
show memory binsize
To display summary information about the chunks allocated for a specific bin size, use the show memory binsize command in privileged EXEC mode.
show memory binsize size
Syntax Description
size
Displays chunks (memory blocks) of a specific bin size. The bin size is from the "fragment size" column of the show memory detail command output.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
This command has no usage guidelines.
Examples
The following example displays summary information about a chunk allocated to a bin size of 500:
hostname# show memory binsize 500pc = 0x00b33657, size = 460 , count = 1Related Commands
show memory delayed-free-poisoner
To display a summary of the memory delayed-free-poisoner queue usage, use the show memory delayed-free-poisoner command in privileged EXEC mode.
show memory delayed-free-poisoner
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
Use the clear memory delayed-free-poisoner command to clear the queue and statistics.
Examples
This following is sample output from the show memory delayed-free-poisoner command:
hostname# show memory delayed-free-poisonerdelayed-free-poisoner statistics:3335600: memory held in queue6095: current queue count0: elements dequeued3: frees ignored by size1530: frees ignored by locking27: successful validate runs0: aborted validate runs01:09:36: local time of last validateTable 7-26 describes the significant fields in the show memory delayed-free-poisoner command output.
Related Commands
show memory profile
To display information about the memory usage (profiling) of the security appliance, use the show memory profile command in privileged EXEC mode.
show memory profile [peak] [detail | collated | status]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
Use the show memory profile command to troubleshoot memory usage level and memory leaks. You can still see the profile buffer contents even if profiling has been stopped. Starting profiling clears the buffer automatically.
Note
Examples
The following example shows...
hostname# show memory profileRange: start = 0x004018b4, end = 0x004169d0, increment = 00000004 Total = 0The output of the show memory profile detail command (below) is divided into six data columns and one header column, at the far left. The address of the memory bucket corresponding to the first data column is given at the header column (the hexidecimal number). The data itself is the number of bytes that is held by the text/code that falls in the bucket address. A period (.) in the data column means no memory is held by the text at this bucket. Other columns in the row correspond to the bucket address that is greater than the increment amount from the previous column. For example, the address bucket of the first data column in the first row is 0x001069e0. The address bucket of the second data column in the first row is 0x001069e4 and so on. Normally the header column address is the next bucket address; that is, the address of the last data column of the previous row plus the increment. All rows without any usage are suppressed. More than one such contiguous row can be suppressed, indicated with three periods at the header column (...).
hostname# show memory profile detailRange: start = 0x00100020, end = 0x00e006e0, increment = 00000004 Total = 48941152 ... 0x001069e0 . 24462 . . . . ... 0x00106d88 . 1865870 . . . . ... 0x0010adf0 . 7788 . . . . ... 0x00113640 . . . . 433152 . ... 0x00116790 2480 . . . . . <snip>The following example shows collated output:
hostname# show memory profile collatedRange: start = 0x00100020, end = 0x00e006e0, increment = 00000004 Total = 48941152 24462 0x001069e4 1865870 0x00106d8c 7788 0x0010adf4 433152 0x00113650 2480 0x00116790 <snip>The following example shows the peak capture buffer:
hostname# show memory profile peakRange: start = 0x004018b4, end = 0x004169d0, increment = 00000004 Total = 102400The following example shows the peak capture buffer and the number of bytes that is held by the text/code that falls in the corresponding bucket address:
hostname# show memory profile peak detailRange: start = 0x004018b4, end = 0x004169d0, increment = 00000004 Total = 102400 ... 0x00404c8c . . 102400 . . .The following example shows the current state of memory profiling and the peak capture buffer:
hostname# show memory profile statusInUse profiling: ON Peak profiling: OFF Memory used by profile buffers: 11518860 bytes Profile: 0x00100020-0x00bfc3a8(00000004)Related Commands
show memory tracking
To display currently allocated memory tracked by the tool, use the show memory tracking command in privileged EXEC mode.
show memory tracking [address | dump | detail]
Syntax Description
address
(Optional) Shows memory tracking by address.
detail
(Optional) Shows internal memory tracking state.
dump
(Optional) Dumps memory tracking address.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
Use the show memory tracking command to show currently allocated memory tracked by the tool.
Examples
The following example shows the show memory tracking command out-put:
hostname# show memory trackingmemory tracking by caller:17 bytes from 1 allocates by 0x080c50c237 bytes from 1 allocates by 0x080c50f657 bytes from 1 allocates by 0x080c512520481 bytes from 1 allocates by 0x080c5154The following examples show the show memory tracking address, and show memory tracking dump outputs:
hostname# show memory tracking addressmemory tracking by caller:17 bytes from 1 allocates by 0x080c50c237 bytes from 1 allocates by 0x080c50f657 bytes from 1 allocates by 0x080c512520481 bytes from 1 allocates by 0x080c5154memory tracking by address:37 byte region @ 0xa893ae80 allocated by 0x080c50f657 byte region @ 0xa893aed0 allocated by 0x080c512520481 byte region @ 0xa8d7cc50 allocated by 0x080c515417 byte region @ 0xa8a6f370 allocated by 0x080c50c2hostname# memory tracking dump 0xa893aed0Tracking data for the 57 byte region at 0xa893aed0:Timestamp: 05:59:36.309 UTC Sun Jul 29 2007Traceback:0x080c51250x080b36950x0873f6060x087405730x080ab5300x080ac7880x080ad1410x0805df8fDumping 57 bytes of the 57 byte region:a893aed0: 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c | ................a893aee0: 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c | ................a893aef0: 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c | ................a893af00: 0c 0c 0c 0c 0c 0c 0c 0c 0c | .........Related Commands
clear memory tracking
Clears all currently gathered information.
show memory tracking
Shows currently allocated memory.
show memory-caller address
To display the address ranges configured on the security appliance, use the show memory-caller address command in privileged EXEC mode.
show memory-caller address
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
•
•
Command History
Usage Guidelines
You must first configure an address ranges with the memory caller-address command before you can display them with the show memory-caller address command.
Examples
The following examples show the address ranges configured with the memory caller-address commands, and the resulting display of the show memory-caller address command:hostname# memory caller-address 0x00109d5c 0x00109e08 hostname# memory caller-address 0x009b0ef0 0x009b0f14 hostname# memory caller-address 0x00cf211c 0x00cf4464hostname# show memory-caller addressMove down stack frame for the addresses: pc = 0x00109d5c-0x00109e08 pc = 0x009b0ef0-0x009b0f14 pc = 0x00cf211c-0x00cf4464If address ranges are not configured before entering the show memory-caller address command, no addresses display:
hostname# show memory-caller addressMove down stack frame for the addresses:
Related Commands
show mfib
To display MFIB in terms of forwarding entries and interfaces, use the show mfib command in user EXEC or privileged EXEC mode.
show mfib [group [source]] [verbose]
Syntax Description
Defaults
Without the optional arguments, information for all groups is shown.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Examples
The following is sample output from the show mfib command:
hostname# show mfib 224.0.2.39Entry Flags: C - Directly Connected, S - Signal, IA - Inherit A flag,AR - Activity Required, D - DropForwarding counts: Pkt Count/Pkts per second/Avg Pkt Size/Kbits per secondOther counts: Total/RPF failed/Other dropsInterface flags: A - Accept, F - Forward, NS - Negate SignallingIC - Internal Copy, NP - Not platform switchedSP - Signal PresentInterface Counts: FS Pkt Count/PS Pkt Count(*,224.0.1.39) Flags: S KForwarding: 0/0/0/0, Other: 0/0/0Related Commands
show mfib verbose
Displays detail information about the forwarding entries and interfaces.
show mfib active
To display active multicast sources, use the show mfib active command in user EXEC or privileged EXEC mode.
show mfib [group] active [kbps]
Syntax Description
group
(Optional) IP address of the multicast group.
kbps
(Optional) Limits the display to multicast streams that are greater-than or equal to this value.
This command has no arguments or keywords.
Defaults
The default value for kbps is 4. If a group is not specified, all groups are shown.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The output for the show mfib active command displays either positive or negative numbers for the rate PPS. The security appliance displays negative numbers when RPF packets fail or when the router observes RPF packets with an interfaces out (OIF) list. This type of activity may indicate a multicast routing problem.
Examples
The following is sample output from the show mfib active command:
hostname# show mfib activeActive IP Multicast Sources - sending >= 4 kbpsGroup: 224.2.127.254, (sdr.cisco.com)Source: 192.168.28.69 (mbone.ipd.anl.gov)Rate: 1 pps/4 kbps(1sec), 4 kbps(last 1 secs), 4 kbps(life avg)Group: 224.2.201.241, ACM 97Source: 192.168.52.160 (webcast3-e1.acm97.interop.net)Rate: 9 pps/93 kbps(1sec), 145 kbps(last 20 secs), 85 kbps(life avg)Group: 224.2.207.215, ACM 97Source: 192.168.52.160 (webcast3-e1.acm97.interop.net)Rate: 3 pps/31 kbps(1sec), 63 kbps(last 19 secs), 65 kbps(life avg)Related Commands
show mfib count
To display MFIB route and packet count data, use the show mfib count command in user EXEC or privileged EXEC mode.
show mfib [group [source]] count
Syntax Description
group
(Optional) IP address of the multicast group.
source
(Optional) IP address of the multicast route source. This is a unicast IP address in four-part dotted-decimal notation.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
This command displays packet drop statistics.
Examples
The following sample output from the show mfib count command:
hostname# show mfib countMFIB global counters are :* Packets [no input idb] : 0* Packets [failed route lookup] : 0* Packets [Failed idb lookup] : 0* Packets [Mcast disabled on input I/F] : 0Related Commands
clear mfib counters
Clears MFIB router packet counters.
show mroute count
Displays multicast route counters.
show mfib interface
To display packet statistics for interfaces that are related to the MFIB process, use the show mfib interface command in user EXEC or privileged EXEC mode.
show mfib interface [interface]
Syntax Description
Defaults
Information for all MFIB interfaces is shown.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Examples
The following example is sample output from the show mfib interface command:
hostname# show mfib interfaceIP Multicast Forwarding (MFIB) status:Configuration Status: enabledOperational Status: runningMFIB interface status CEF-based output[configured,available]Ethernet0 up [ no, no]Ethernet1 up [ no, no]Ethernet2 up [ no, no]Related Commands
show mfib
Displays MFIB information in terms of forwarding entries and interfaces.
show mfib reserved
To display reserved groups, use the show mfib reserved command in user EXEC or privileged EXEC mode.
show mfib reserved [count | verbose | active [kpbs]]
Syntax Description
Defaults
The default value for kbps is 4.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
This command displays MFIB entries in the range 224.0.0.0 through 224.0.0.225.
Examples
The following is sample output from the show mfib reserved command:
hostname# command exampleEntry Flags: C - Directly Connected, S - Signal, IA - Inherit A flag,AR - Activity Required, D - Drop Forwarding Counts: Pkt Count/Pkts per second/Avg Pkt Size/Kbits per second Other counts: Total/RPF failed/Other drops Interface Flags: A - Accept, F - Forward, NS - Negate SignallingIC - Internal Copy, NP - Not platform switchedSP - Signal PresentInterface Counts: FS Pkt Count/PS Pkt Count(*,224.0.0.0/4) Flags: C KForwarding: 0/0/0/0, Other: 0/0/0(*,224.0.0.0/24) Flags: KForwarding: 0/0/0/0, Other: 0/0/0(*,224.0.0.1) Flags:Forwarding: 0/0/0/0, Other: 0/0/0outside Flags: ICdmz Flags: ICinside Flags: ICRelated Commands
show mfib status
To display the general MFIB configuration and operational status, use the show mfib status command in user EXEC or privileged EXEC mode.
show mfib status
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Examples
The following is sample output from the show mfib status command:
hostname# show mfib statusIP Multicast Forwarding (MFIB) status:Configuration Status: enabledOperational Status: runningRelated Commands
show mfib
Displays MFIB information in terms of forwarding entries and interfaces.
show mfib summary
To display summary information about the number of MFIB entries and interfaces, use the show mfib summary command in user EXEC or privileged EXEC mode.
show mfib summary
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Examples
The following is sample output from the show mfib summary command:
hostname# show mfib summaryIPv6 MFIB summary:54 total entries [1 (S,G), 7 (*,G), 46 (*,G/m)]17 total MFIB interfacesRelated Commands
show mfib verbose
To display detail information about the forwarding entries and interfaces, use the show mfib verbose command in user EXEC or privileged EXEC mode.
show mfib verbose
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Examples
The following is sample output from the show mfib verbose command:
hostname# show mfib verboseEntry Flags: C - Directly Connected, S - Signal, IA - Inherit A flag,AR - Activity Required, D - DropForwarding counts: Pkt Count/Pkts per second/Avg Pkt Size/Kbits per secondOther counts: Total/RPF failed/Other dropsInterface flags: A - Accept, F - Forward, NS - Negate SignallingIC - Internal Copy, NP - Not platform switchedSP - Signal PresentInterface Counts: FS Pkt Count/PS Pkt Count(*,224.0.1.39) Flags: S KForwarding: 0/0/0/0, Other: 0/0/0(*,224.0.1.40) Flags: S KForwarding: 0/0/0/0, Other: 0/0/0(*,224.0.0.0/8) Flags: KForwarding: 0/0/0/0, Other: 0/0/0Related Commands
show mfib
Displays MFIB information in terms of forwarding entries and interfaces.
show mfib summary
Displays summary information about the number of MFIB entries and interfaces.
show mgcp
To display MGCP configuration and session information, use the show mgcp command in privileged EXEC mode.
show mgcp {commands | sessions} [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show mgcp commands command lists the number of MGCP commands in the command queue. The show mgcp sessions command lists the number of existing MGCP sessions. The detail option includes additional information about each command (or session) in the output.
Examples
The following are examples of the show mgcp command options:
hostname# show mgcp commands1 in use, 1 most used, 200 maximum allowedCRCX, gateway IP: host-pc-2, transaction ID: 2052, idle: 0:00:07hostname# show mgcp commands detail1 in use, 1 most used, 200 maximum allowedCRCX, idle: 0:00:10Gateway IP | host-pc-2Transaction ID 2052Endpoint name | aaln/1Call ID | 9876543210abcdefConnection ID |Media IP | 192.168.5.7Media port | 6058hostname# show mgcp sessions1 in use, 1 most usedGateway IP host-pc-2, connection ID 6789af54c9, active 0:00:11hostname# show mgcp sessions detail1 in use, 1 most usedSession active 0:00:14Gateway IP | host-pc-2Call ID | 9876543210abcdefConnection ID | 6789af54c9Endpoint name | aaln/1Media lcl port 6166Media rmt IP | 192.168.5.7Media rmt port 6058Related Commands
show mode
To show the security context mode for the running software image and for any image in Flash memory, use the show mode command in privileged EXEC mode.
show mode
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following is sample output from the show mode command. The following example shows the current mode and the mode for the non-running image "image.bin":
hostname# show mode flash:/image.binFirewall mode: multipleThe mode can be multiple or single.
Related Commands
context
Creates a security context in the system configuration and enters context configuration mode.
mode
Sets the context mode to single or multiple.
show module
To show information about the SSM on the ASA 5500 series adaptive security appliance as well as system information, use the show module command in user EXEC mode.
show module [slot [details] | all | 1 recover]]
Syntax Description
Defaults
Shows information for both slots.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
•
•
1 The show module recover command is only available in the system execution space.
Command History
Usage Guidelines
This command shows information about the SSM as well as the system and built-in interfaces.
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show module command. Slot 0 is the system, while slot 1 is an SSM.
hostname> show moduleMod Card Type Model Serial No.--- -------------------------------------------- ------------------ -----------0 ASA 5520 Adaptive Security Appliance ASA5520 XXXXXXXXXXX1 ASA 5500 Series Security Services Module-20 ASA-SSM-20 XXXXXXXXXXXMod MAC Address Range Hw Version Fw Version Sw Version--- --------------------------------- ------------ ------------ ---------------0 000b.fcf8.c619 to 000b.fcf8.c61d 1.0 1.0(6)5 7.0(0)771 000b.fcf8.019f to 000b.fcf8.019f 1.0 1.0(6)5 5.0(0.15)S91(0.15)Mod Status--- ------------------0 Up Sys1 UpTable 22 shows each field description.
The following is sample output from the show module details command:
hostname> show module 1 detailsGetting details from the Service Module, please wait...ASA 5500 Series Security Services Module-20Model: ASA-SSM-20Hardware version: V1.0Serial Number: 12345678Firmware version: 1.0(7)2Software version: 4.1(1.1)S47(0.1)MAC Address Range: 000b.fcf8.0156 to 000b.fcf8.0156Status: UpMgmt IP addr: 10.89.147.13Mgmt web ports: 443Mgmt TLS enabled: trueTable 23 shows each field description. See Table 22 for fields that are also shown for the show module command.
The following is sample output from the show module recover command:
hostname> show module 1 recoverModule 1 recover parameters...Boot Recovery Image: YesImage URL: tftp://10.21.18.1/ids-oldimgPort IP Address: 10.1.2.10Port Mask : 255.255.255.0Gateway IP Address: 10.1.2.254Related Commands
show mrib client
To display information about the MRIB client connections, use the show mrib client command in user EXEC or privileged EXEC mode.
show mrib client [filter] [name client_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The filter option is used to display the route and interface level flag changes that various MRIB clients have registered. This command option also shows what flags are owned by the MRIB clients.
Examples
The following sample output from the show mrib client command using the filter keyword:
hostname# show mrib client filterMFWD:0 (connection id 0)interest filter:entry attributes: S C IA Dinterface attributes: F A IC NS DP SPgroups:include 0.0.0.0/0interfaces:include Allownership filter:groups:include 0.0.0.0/0interfaces:include Alligmp:77964 (connection id 1)ownership filter:interface attributes: II ID LI LDgroups:include 0.0.0.0/0interfaces:include Allpim:49287 (connection id 5)interest filter:entry attributes: Einterface attributes: SP II ID LI LDgroups:include 0.0.0.0/0interfaces:include Allownership filter:entry attributes: L S C IA Dinterface attributes: F A IC NS DPgroups:include 0.0.0.0/0interfaces:include AllRelated Commands
show mrib route
To display entries in the MRIB table, use the show mrib route command in user EXEC or privileged EXEC mode.
show mrib route [[source | *] [group[/prefix-length]]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The MFIB table maintains a subset of entries and flags updated from MRIB. The flags determine the forwarding and signaling behavior according to a set of forwarding rules for multicast packets.
In addition to the list of interfaces and flags, each route entry shows various counters. Byte count is the number of total bytes forwarded. Packet count is the number of packets received for this entry. The show mfib count command displays global counters independent of the routes.
Examples
The following is sample output from the show mrib route command:
hostname# show mrib routeIP Multicast Routing Information BaseEntry flags: L - Domain-Local Source, E - External Source to the Domain,C - Directly-Connected Check, S - Signal, IA - Inherit Accept, D - DropInterface flags: F - Forward, A - Accept, IC - Internal Copy,NS - Negate Signal, DP - Don't Preserve, SP - Signal Present,II - Internal Interest, ID - Internal Disinterest, LI - Local Interest,LD - Local Disinterest(*,224.0.0.0/4) RPF nbr: 10.11.1.20 Flags: L CDecapstunnel0 Flags: NS(*,224.0.0.0/24) Flags: D(*,224.0.1.39) Flags: S(*,224.0.1.40) Flags: SPOS0/3/0/0 Flags: II LI(*,238.1.1.1) RPF nbr: 10.11.1.20 Flags: CPOS0/3/0/0 Flags: F NS LIDecapstunnel0 Flags: A(*,239.1.1.1) RPF nbr: 10.11.1.20 Flags: CPOS0/3/0/0 Flags: F NSDecapstunnel0 Flags: ARelated Commands
show mfib count
Displays route and packet count data for the MFIB table.
show mrib route summary
Displays a summary of the MRIB table entries.
show mroute
To display the IPv4 multicast routing table, use the show mroute command in privileged EXEC mode.
show mroute [group [source] | reserved] [active [rate] | count | pruned | summary]
Syntax Description
Defaults
If not specified, the rate argument defaults to 4 kbps.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The show mroute command displays the contents of the multicast routing table. The security appliance populates the multicast routing table by creating (S,G) and (*,G) entries based on PIM protocol messages, IGMP reports, and traffic. The asterisk (*) refers to all source addresses, the "S" refers to a single source address, and the "G" is the destination multicast group address. In creating (S, G) entries, the software uses the best path to that destination group found in the unicast routing table (through RPF).
To view the mroute commands in the running configuration, use the show running-config mroute command.
Examples
The following is sample output from the show mroute command:
hostname(config)# show mrouteMulticast Routing TableFlags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group,C - Connected, L - Local, I - Received Source Specific Host Report,P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set,J - Join SPTTimers: Uptime/ExpiresInterface state: Interface, State(*, 239.1.1.40), 08:07:24/never, RP 0.0.0.0, flags: DPCIncoming interface: NullRPF nbr: 0.0.0.0Outgoing interface list:inside, Null, 08:05:45/nevertftp, Null, 08:07:24/never(*, 239.2.2.1), 08:07:44/never, RP 140.0.0.70, flags: SCJIncoming interface: outsideRPF nbr: 140.0.0.70Outgoing interface list:inside, Forward, 08:07:44/neverThe following fields are shown in the show mroute output:
•
–
–
–
–
–
–
–
–
–
–
–
–
For (S, G) entries, indicates that the entry was created because the SPT-Threshold for the group was exceeded. When the J - Join SPT flag is set for (S, G) entries, the security appliance monitors the traffic rate on the source tree and attempts to switch back to the shared tree for this source if the traffic rate on the source tree falls below the SPT-Threshold of the group for more than 1 minute.
Note
If the default SPT-Threshold value of 0 kbps is used for the group, the J - Join SPT flag is always set on (*, G) entries and is never cleared. When the default SPT-Threshold value is used, the security appliance immediately switches to the shortest path source tree when traffic from a new source is received.
•
•
–
–
•
•
•
•
•
Related Commands
show nameif
To view the interface name set using the nameif command, use the show nameif command in privileged EXEC mode.
show nameif [physical_interface[.subinterface] | mapped_name]
Syntax Description
Defaults
If you do not specify an interface, the security appliance shows all interface names.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
In multiple context mode, if you mapped the interface ID in the allocate-interface command, you can only specify the mapped name in a context. The output for this command shows only the mapped name in the Interface column.
Examples
The following is sample output from the show nameif command:
hostname# show nameifInterface Name SecurityGigabitEthernet0/0 outside 0GigabitEthernet0/1 inside 100GigabitEthernet0/2 test2 50Related Commands
show ntp associations
To view NTP association information, use the show ntp associations command in user EXEC mode.
show ntp associations [detail]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
—
•
Command History
Usage Guidelines
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show ntp associations command:
hostname> show ntp associationsaddress ref clock st when poll reach delay offset disp~172.31.32.2 172.31.32.1 5 29 1024 377 4.2 -8.59 1.6+~192.168.13.33 192.168.1.111 3 69 128 377 4.1 3.48 2.3*~192.168.13.57 192.168.1.111 3 32 128 377 7.9 11.18 3.6* master (synced), # master (unsynced), + selected, - candidate, ~ configuredTable 7-26 shows each field description.
The following is sample output from the show ntp associations detail command:
hostname> show ntp associations detail172.23.56.249 configured, our_master, sane, valid, stratum 4ref ID 172.23.56.225, time c0212639.2ecfc9e0 (20:19:05.182 UTC Fri Feb 22 2002)our mode client, peer mode server, our poll intvl 128, peer poll intvl 128root delay 38.04 msec, root disp 9.55, reach 177, sync dist 156.021delay 4.47 msec, offset -0.2403 msec, dispersion 125.21precision 2**19, version 3org time c02128a9.731f127b (20:29:29.449 UTC Fri Feb 22 2002)rcv time c02128a9.73c1954b (20:29:29.452 UTC Fri Feb 22 2002)xmt time c02128a9.6b3f729e (20:29:29.418 UTC Fri Feb 22 2002)filtdelay = 4.47 4.58 4.97 5.63 4.79 5.52 5.87 0.00filtoffset = -0.24 -0.36 -0.37 0.30 -0.17 0.57 -0.74 0.00filterror = 0.02 0.99 1.71 2.69 3.66 4.64 5.62 16000.0Table 7-27 shows each field description.
Related Commands
show ntp status
To show the status of each NTP association, use the show ntp status command in user EXEC mode.
show ntp status
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
—
•
Command History
Usage Guidelines
See the "Examples" section for a description of the display output.
Examples
The following is sample output from the show ntp status command:
hostname> show ntp statusClock is synchronized, stratum 5, reference is 172.23.56.249nominal freq is 99.9984 Hz, actual freq is 100.0266 Hz, precision is 2**6reference time is c02128a9.73c1954b (20:29:29.452 UTC Fri Feb 22 2002)clock offset is -0.2403 msec, root delay is 42.51 msecroot dispersion is 135.01 msec, peer dispersion is 125.21 msecTable 7-28 shows each field description.
Related Commands
show ospf
To display the general information about the OSPF routing processes, use the show ospf command in privileged EXEC mode.
show ospf [pid [area_id]]
Syntax Description
area_id
(Optional) ID of the area that is associated with the OSPF address range.
pid
(Optional) The ID of the OSPF process.
Defaults
Lists all OSPF processes if no pid is specified.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
If the pid is included, only information for the specified routing process is included.
Examples
The following is sample output from the show ospf command, showing how to display general information about a specific OSPF routing process:
hostname# show ospf 5Routing Process "ospf 5" with ID 127.0.0.1 and Domain ID 0.0.0.5Supports only single TOS(TOS0) routesSupports opaque LSASPF schedule delay 5 secs, Hold time between two SPFs 10 secsMinimum LSA interval 5 secs. Minimum LSA arrival 1 secsNumber of external LSA 0. Checksum Sum 0x 0Number of opaque AS LSA 0. Checksum Sum 0x 0Number of DCbitless external and opaque AS LSA 0Number of DoNotAge external and opaque AS LSA 0Number of areas in this router is 0. 0 normal 0 stub 0 nssaExternal flood list length 0The following is sample output from the show ospf command, showing how to display general information about all OSPF routing processes:
hostname# show ospfRouting Process "ospf 5" with ID 127.0.0.1 and Domain ID 0.0.0.5Supports only single TOS(TOS0) routesSupports opaque LSASPF schedule delay 5 secs, Hold time between two SPFs 10 secsMinimum LSA interval 5 secs. Minimum LSA arrival 1 secsNumber of external LSA 0. Checksum Sum 0x 0Number of opaque AS LSA 0. Checksum Sum 0x 0Number of DCbitless external and opaque AS LSA 0Number of DoNotAge external and opaque AS LSA 0Number of areas in this router is 0. 0 normal 0 stub 0 nssaExternal flood list length 0Routing Process "ospf 12" with ID 172.23.59.232 and Domain ID 0.0.0.12Supports only single TOS(TOS0) routesSupports opaque LSASPF schedule delay 5 secs, Hold time between two SPFs 10 secsMinimum LSA interval 5 secs. Minimum LSA arrival 1 secsNumber of external LSA 0. Checksum Sum 0x 0Number of opaque AS LSA 0. Checksum Sum 0x 0Number of DCbitless external and opaque AS LSA 0Number of DoNotAge external and opaque AS LSA 0Number of areas in this router is 0. 0 normal 0 stub 0 nssaExternal flood list length 0Related Commands
show ospf border-routers
To display the internal OSPF routing table entries to ABRs and ASBRs, use the show ospf border-routers command in privileged EXEC mode.
show ospf border-routers
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Examples
The following is sample output from the show ospf border-routers command:
hostname# show ospf border-routersOSPF Process 109 internal Routing TableCodes: i - Intra-area route, I - Inter-area routei 192.168.97.53 [10] via 192.168.1.53, fifth, ABR, Area 0, SPF 20i 192.168.103.51 [10] via 192.168.96.51, outside, ASBR, Area 192.168.12.0, SPF 14i 192.168.103.52 [10] via 192.168.96.51, outside, ABR/ASBR, Area 192.168.12.0, SPF 14Related Commands
show ospf database
To display the information contained in the OSPF topological database on the security appliance, use the show ospf database command in privileged EXEC mode.
show ospf [pid [area_id]] database [router | network | summary | asbr-summary | external | nssa-external] [lsid] [internal] [self-originate | adv-router addr]
show ospf [pid [area_id]] database database-summary
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The OSPF routing-related show commands are available in privileged mode on the security appliance. You do not need to be in an OSPF configuration mode to use the OSPF-related show commands.
Examples
The following is sample output from the show ospf database command:
hostname# show ospf databaseOSPF Router with ID(192.168.1.11) (Process ID 1)Router Link States(Area 0)Link ID ADV Router Age Seq# Checksum Link count192.168.1.8 192.168.1.8 1381 0x8000010D 0xEF60 2192.168.1.11 192.168.1.11 1460 0x800002FE 0xEB3D 4192.168.1.12 192.168.1.12 2027 0x80000090 0x875D 3192.168.1.27 192.168.1.27 1323 0x800001D6 0x12CC 3Net Link States(Area 0)Link ID ADV Router Age Seq# Checksum172.16.1.27 192.168.1.27 1323 0x8000005B 0xA8EE172.17.1.11 192.168.1.11 1461 0x8000005B 0x7ACType-10 Opaque Link Area Link States (Area 0)Link ID ADV Router Age Seq# Checksum Opaque ID10.0.0.0 192.168.1.11 1461 0x800002C8 0x8483 010.0.0.0 192.168.1.12 2027 0x80000080 0xF858 010.0.0.0 192.168.1.27 1323 0x800001BC 0x919B 010.0.0.1 192.168.1.11 1461 0x8000005E 0x5B43 1The following is sample output from the show ospf database asbr-summary command:
hostname# show ospf database asbr-summaryOSPF Router with ID(192.168.239.66) (Process ID 300)Summary ASB Link States(Area 0.0.0.0)Routing Bit Set on this LSALS age: 1463Options: (No TOS-capability)LS Type: Summary Links(AS Boundary Router)Link State ID: 172.16.245.1 (AS Boundary Router address)Advertising Router: 172.16.241.5LS Seq Number: 80000072Checksum: 0x3548Length: 28Network Mask: 0.0.0.0TOS: 0 Metric: 1The following is sample output from the show ospf database router command:
hostname# show ospf database routerOSPF Router with id(192.168.239.66) (Process ID 300)Router Link States(Area 0.0.0.0)Routing Bit Set on this LSALS age: 1176Options: (No TOS-capability)LS Type: Router LinksLink State ID: 10.187.21.6Advertising Router: 10.187.21.6LS Seq Number: 80002CF6Checksum: 0x73B7Length: 120AS Boundary RouterNumber of Links: 8Link connected to: another Router (point-to-point)(link ID) Neighboring Router ID: 10.187.21.5(Link Data) Router Interface address: 10.187.21.6Number of TOS metrics: 0TOS 0 Metrics: 2The following is sample output from the show ospf database network command:
hostname# show ospf database networkOSPF Router with id(192.168.239.66) (Process ID 300)Displaying Net Link States(Area 0.0.0.0)LS age: 1367Options: (No TOS-capability)LS Type: Network LinksLink State ID: 10.187.1.3 (address of Designated Router)Advertising Router: 192.168.239.66LS Seq Number: 800000E7Checksum: 0x1229Length: 52Network Mask: 255.255.255.0Attached Router: 192.168.239.66Attached Router: 10.187.241.5Attached Router: 10.187.1.1Attached Router: 10.187.54.5Attached Router: 10.187.1.5The following is sample output from the show ospf database summary command:
hostname# show ospf database summaryOSPF Router with id(192.168.239.66) (Process ID 300)Displaying Summary Net Link States(Area 0.0.0.0)LS age: 1401Options: (No TOS-capability)LS Type: Summary Links(Network)Link State ID: 10.187.240.0 (summary Network Number)Advertising Router: 10.187.241.5LS Seq Number: 80000072Checksum: 0x84FFLength: 28Network Mask: 255.255.255.0 TOS: 0 Metric: 1The following is sample output from the show ospf database external command:
hostname# show ospf database externalOSPF Router with id(192.168.239.66) (Autonomous system 300)Displaying AS External Link StatesLS age: 280Options: (No TOS-capability)LS Type: AS External LinkLink State ID: 172.16.0.0 (External Network Number)Advertising Router: 10.187.70.6LS Seq Number: 80000AFDChecksum: 0xC3ALength: 36Network Mask: 255.255.0.0Metric Type: 2 (Larger than any link state path)TOS: 0Metric: 1Forward Address: 0.0.0.0External Route Tag: 0Related Commands
show ospf flood-list
To display a list of OSPF LSAs waiting to be flooded over an interface, use the show ospf flood-list command in privileged EXEC mode.
show ospf flood-list interface_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The OSPF routing-related show commands are available in privileged mode on the security appliance. You do not need to be in an OSPF configuration mode to use the OSPF-related show commands.
Examples
The following is sample output from the show ospf flood-list command:
hostname# show ospf flood-list outsideInterface outside, Queue length 20Link state flooding due in 12 msecType LS ID ADV RTR Seq NO Age Checksum5 10.2.195.0 192.168.0.163 0x80000009 0 0xFB615 10.1.192.0 192.168.0.163 0x80000009 0 0x29385 10.2.194.0 192.168.0.163 0x80000009 0 0x7575 10.1.193.0 192.168.0.163 0x80000009 0 0x1E425 10.2.193.0 192.168.0.163 0x80000009 0 0x124D5 10.1.194.0 192.168.0.163 0x80000009 0 0x134CRelated Commands
show ospf interface
To display the OSPF-related interface information, use the show ospf interface command in privileged EXEC mode.
show ospf interface [interface_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
When used without the interface_name argument, the OSPF information for all interfaces is shown.
Examples
The following is sample output from the show ospf interface command:
hostname# show ospf interface insideinside is up, line protocol is upInternet Address 192.168.254.202, Mask 255.255.255.0, Area 0.0.0.0AS 201, Router ID 192.77.99.1, Network Type BROADCAST, Cost: 10Transmit Delay is 1 sec, State OTHER, Priority 1Designated Router id 192.168.254.10, Interface address 192.168.254.10Backup Designated router id 192.168.254.28, Interface addr 192.168.254.28Timer intervals configured, Hello 10, Dead 60, Wait 40, Retransmit 5Hello due in 0:00:05Neighbor Count is 8, Adjacent neighbor count is 2Adjacent with neighbor 192.168.254.28 (Backup Designated Router)Adjacent with neighbor 192.168.254.10 (Designated Router)Related Commands
show ospf neighbor
To display the OSPF-neighbor information on a per-interface basis, use the show ospf neighbor command in privileged EXEC mode.
show ospf neighbor [detail | interface_name [nbr_router_id]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Examples
The following is sample output from the show ospf neighbor command. It shows how to display the OSPF-neighbor information on a per-interface basis.
hostname# show ospf neighbor outsideNeighbor 192.168.5.2, interface address 10.225.200.28In the area 0 via interface outsideNeighbor priority is 1, State is FULL, 6 state changesDR is 10.225.200.28 BDR is 10.225.200.30Options is 0x42Dead timer due in 00:00:36Neighbor is up for 00:09:46Index 1/1, retransmission queue length 0, number of retransmission 1First 0x0(0)/0x0(0) Next 0x0(0)/0x0(0)Last retransmission scan length is 1, maximum is 1Last retransmission scan time is 0 msec, maximum is 0 msecRelated Commands
neighbor
Configures OSPF routers interconnecting to non-broadcast networks.
router ospf
Enables OSPF routing and configures global OSPF routing parameters.
show ospf request-list
To display a list of all LSAs that are requested by a router, use the show ospf request-list command in privileged EXEC mode.
show ospf request-list nbr_router_id interface_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Examples
The following is sample output from the show ospf request-list command:
hostname# show ospf request-list 192.168.1.12 insideOSPF Router with ID (192.168.1.11) (Process ID 1)Neighbor 192.168.1.12, interface inside address 172.16.1.12Type LS ID ADV RTR Seq NO Age Checksum1 192.168.1.12 192.168.1.12 0x8000020D 8 0x6572Related Commands
show ospf retransmission-list
To display a list of all LSAs waiting to be resent, use the show ospf retransmission-list command in privileged EXEC mode.
show ospf retransmission-list nbr_router_id interface_name
Syntax Description
interface_name
Name of the interface for which to display neighbor information.
nbr_router_id
Router ID of the neighbor router.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The OSPF routing-related show commands are available in privileged mode on the security appliance. You do not need to be in an OSPF configuration mode to use the OSPF-related show commands.
The nbr_router_id argument displays the list of all LSAs that are waiting to be resent for this neighbor.
The interface_name argument displays the list of all LSAs that are waiting to be resent for this interface.
Examples
The following is sample output from the show ospf retransmission-list command, where the nbr_router_id argument is 192.168.1.11 and the if_name argument is outside:
hostname# show ospf retransmission-list 192.168.1.11 outsideOSPF Router with ID (192.168.1.12) (Process ID 1)Neighbor 192.168.1.11, interface outside address 172.16.1.11Link state retransmission due in 3764 msec, Queue length 2Type LS ID ADV RTR Seq NO Age Checksum1 192.168.1.12 192.168.1.12 0x80000210 0 0xB196Related Commands
show ospf request-list
Displays a list of all LSAs that are requested by a router.
show ospf summary-address
To display a list of all summary address redistribution information that is configured under an OSPF process, use the show ospf summary-address command in privileged EXEC mode.
show ospf summary-address
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Examples
The following shows sample output from the show ospf summary-address command. It shows how to display a list of all summary address redistribution information before a summary address has been configured for an OSPF process with the ID of 5.
hostname# show ospf 5 summary-addressOSPF Process 2, Summary-address10.2.0.0/255.255.0.0 Metric -1, Type 0, Tag 010.2.0.0/255.255.0.0 Metric -1, Type 0, Tag 10Related Commands
show ospf virtual-links
To display the parameters and the current state of OSPF virtual links, use the show ospf virtual-links command in privileged EXEC mode.
show ospf virtual-links
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Examples
The following is sample output from the show ospf virtual-links command:
hostname# show ospf virtual-linksVirtual Link to router 192.168.101.2 is upTransit area 0.0.0.1, via interface Ethernet0, Cost of using 10Transmit Delay is 1 sec, State POINT_TO_POINTTimer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5Hello due in 0:00:08Adjacency State FULLRelated Commands
show perfmon
To display information about the performance of the security appliance, use the show perfmon command.
show perfmon
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
Command History
Usage Guidelines
This command output does not display in a Telnet console session.
The perfmon command allows you to monitor the security appliance's performance. The show perfmon command allows you to display the information immediately.
Examples
This example shows how to display information about the security appliance performance:
hostname(config)# show perfmonContext: my_contextPERFMON STATS: Current AverageXlates 0/s 0/sConnections 0/s 0/sTCP Conns 0/s 0/sUDP Conns 0/s 0/sURL Access 0/s 0/sURL Server Req 0/s 0/sTCP Fixup 0/s 0/sTCP Intercept Established Conns 0/s 0/sTCP Intercept Attempts 0/s 0/sTCP Embryonic Conns Timeout 0/s 0/sHTTP Fixup 0/s 0/sFTP Fixup 0/s 0/sAAA Authen 0/s 0/sAAA Author 0/s 0/sAAA Account 0/s 0/sVALID CONNS RATE in TCP INTERCEPT: Current Average100.00% 100.00%Related Commands
show pim df
To display the bidirectional DF "winner" for a rendezvous point (RP) or interface, use the show pim df command in user EXEC or privileged EXEC mode.
show pim df [winner] [rp_address | if_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
This command also displays the winner metric towards the RP.
Examples
The following is sample output from the show pim df command:
hostname# show df winner insideRP Interface DF Winner Metrics172.16.1.3 Loopback3 172.17.3.2 [110/2]172.16.1.3 Loopback2 172.17.2.2 [110/2]172.16.1.3 Loopback1 172.17.1.2 [110/2]172.16.1.3 inside 10.10.2.3 [0/0]172.16.1.3 inside 10.10.1.2 [110/2]show pim group-map
To display group-to-protocol mapping table, use the show pim group-map command in user EXEC or privileged EXEC mode.
show pim group-map [info-source] [group]
Syntax Description
Defaults
Displays group-to-protocol mappings for all groups.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
This command displays all group protocol address mappings for the RP. Mappings are learned on the security appliance from different clients.
The PIM implementation on the security appliance has various special entries in the mapping table. Auto-rp group ranges are specifically denied from sparse-mode group range. SSM group range also does not fall under sparse-mode. Link Local multicast groups (224.0.0.0-224.0.0.225, as defined by 224.0.0.0/24) are also denied from the sparse-mode group range. The last entry shows all remaining groups in Sparse-Mode with a given RP.
If multiple RPs are configured with the pim rp-address command, then the appropriate group range is displayed with their corresponding RPs.
Examples
The following is sample output form the show pim group-map command:
hostname# show pim group-mapGroup Range Proto Client Groups RP address Info224.0.1.39/32* DM static 1 0.0.0.0224.0.1.40/32* DM static 1 0.0.0.0224.0.0.0/24* NO static 0 0.0.0.0232.0.0.0/8* SSM config 0 0.0.0.0224.0.0.0/4* SM autorp 1 10.10.2.2 RPF: POS01/0/3,10.10.3.2In lines 1 and 2, Auto-RP group ranges are specifically denied from the sparse mode group range.
In line 3, link-local multicast groups (224.0.0.0 to 224.0.0.255 as defined by 224.0.0.0/24) are also denied from the sparse mode group range.
In line 4, the PIM Source Specific Multicast (PIM-SSM) group range is mapped to 232.0.0.0/8.
The last entry shows that all the remaining groups are in sparse mode mapped to RP 10.10.3.2.
Related Commands
multicast-routing
Enables multicast routing on the security appliance.
pim rp-address
Configures the address of a PIM rendezvous point (RP).
show pim interface
To display interface-specific information for PIM, use the show pim interface command in user EXEC or privileged EXEC mode.
show pim interface [if_name | state-off | state-on]
Syntax Description
Defaults
If you do not specify an interface, PIM information for all interfaces is shown.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The PIM implementation on the security appliance considers the security appliance itself a PIM neighbor. Therefore, the neighbor count column in the output of this command shows one more than the actual number of neighbors.
Examples
The following example displays PIM information for the inside interface:
hostname# show pim interface insideAddress Interface Ver/ Nbr Query DR DRMode Count Intvl Prior172.16.1.4 inside v2/S 2 100 ms 1 172.16.1.4Related Commands
show pim join-prune statistic
To display PIM join/prune aggregation statistics, use the show pim join-prune statistics command in user EXEC or privileged EXEC mode.
show pim join-prune statistics [if_name]
Syntax Description
if_name
(Optional) The name of an interface. Including this argument limits the displayed information to the specified interface.
Defaults
If an interface is not specified, this command shows the join/prune statistics for all interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
Clear the PIM join/prune statistics with the clear pim counters command.
Examples
The following is sample output from the show pim join-prune statistic command:
hostname# show pim join-prune statisticPIM Average Join/Prune Aggregation for last (1K/10K/50K) packetsInterface Transmitted Receivedinside 0 / 0 / 0 0 / 0 / 0GigabitEthernet1 0 / 0 / 0 0 / 0 / 0Ethernet0 0 / 0 / 0 0 / 0 / 0Ethernet3 0 / 0 / 0 0 / 0 / 0GigabitEthernet0 0 / 0 / 0 0 / 0 / 0Ethernet2 0 / 0 / 0 0 / 0 / 0Related Commands
show pim neighbor
To display entries in the PIM neighbor table, use the show pim neighbor command in user EXEC or privileged EXEc mode.
show pim neighbor [count | detail] [interface]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
This command is used to determine the PIM neighbors known to this router through PIM hello messages. Also, this command indicates that an interface is a designated router (DR) and when the neighbor is capable of bidirectional operation.
The PIM implementation on the security appliance considers the security appliance itself to be a PIM neighbor. Therefore, the security appliance interface is shown in the output of this command. The IP address of the security appliance is indicated by an asterisk next to the address.
Examples
The following is sample output from the show pim neighbor command:
hostname# show pim neighbor insideNeighbor Address Interface Uptime Expires DR pri Bidir10.10.1.1 inside 03:40:36 00:01:41 1 B10.10.1.2* inside 03:41:28 00:01:32 1 (DR) BRelated Commands
show pim range-list
To display range-list information for PIM, use the show pim range-list command in user EXEC or privileged EXEC mode.
show pim range-list [rp_address]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
This command is used to determine the multicast forwarding mode to group mapping. The output also indicates the rendezvous point (RP) address for the range, if applicable.
Examples
The following is sample output from the show pim range-list command:
hostname# show pim range-listconfig SSM Exp: never Src: 0.0.0.0230.0.0.0/8 Up: 03:47:09config BD RP: 172.16.1.3 Exp: never Src: 0.0.0.0239.0.0.0/8 Up: 03:47:16config BD RP: 172.18.1.6 Exp: never Src: 0.0.0.0239.100.0.0/16 Up: 03:47:10config SM RP: 172.18.2.6 Exp: never Src: 0.0.0.0235.0.0.0/8 Up: 03:47:09Related Commands
show pim group-map
Displays group-to-PIM mode mapping and active RP information.
show pim topology
To display PIM topology table information, use the show pim topology command in user EXEC or privileged EXEC mode.
show pim topology [group] [source]
Syntax Description
Defaults
Topology information for all groups and sources is shown.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
Use the PIM topology table to display various entries for a given group, (*, G), (S, G), and (S, G)RPT, each with its own interface list.
PIM communicates the contents of these entries through the MRIB, which is an intermediary for communication between multicast routing protocols, such as PIM, local membership protocols, such as Internet Group Management Protocol (IGMP), and the multicast forwarding engine of the system.
The MRIB shows on which interface the data packet should be accepted and on which interfaces the data packet should be forwarded, for a given (S, G) entry. Additionally, the Multicast Forwarding Information Base (MFIB) table is used during forwarding to decide on per-packet forwarding actions.
Note
Examples
The following is sample output from the show pim topology command:
hostname# show pim topologyIP PIM Multicast Topology TableEntry state: (*/S,G)[RPT/SPT] Protocol Uptime InfoEntry flags: KAT - Keep Alive Timer, AA - Assume Alive, PA - Probe Alive,RA - Really Alive, LH - Last Hop, DSS - Don't Signal Sources,RR - Register Received, SR(*,224.0.1.40) DM Up: 15:57:24 RP: 0.0.0.0JP: Null(never) RPF: ,0.0.0.0 Flags: LH DSSoutside 15:57:24 off LI LH(*,224.0.1.24) SM Up: 15:57:20 RP: 0.0.0.0JP: Join(00:00:32) RPF: ,0.0.0.0 Flags: LHoutside 15:57:20 fwd LI LH(*,224.0.1.60) SM Up: 15:57:16 RP: 0.0.0.0JP: Join(00:00:32) RPF: ,0.0.0.0 Flags: LHoutside 15:57:16 fwd LI LHRelated Commands
show pim topology reserved
To display PIM topology table information for reserved groups, use the show pim topology reserved command in user EXEC or privileged EXEC mode.
show pim topology reserved
Syntax Description
This command has no arguments or keywords.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or privileged EXEC
•
—
•
—
—
Command History
Examples
None.
Related Commands
show pim topology route-count
To display PIM topology table entry counts, use the show pim topology route-count command in user EXEC or privileged EXEC mode.
show pim topology route-count [detail]
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
This command displays the count of entries in the PIM topology table. To display more information about the entries, use the show pim topology command.
Examples
The following is sample output from the show pim topology route-count command:
hostname# show pim topology route-countPIM Topology Table SummaryNo. of group ranges = 5No. of (*,G) routes = 0No. of (S,G) routes = 0No. of (S,G)RPT routes = 0Related Commands
show pim traffic
To display PIM traffic counters, use the show pim traffic command in user EXEC or privileged EXEC mode.
show pim traffic
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
Clear the PIM traffic counters with the clear pim counters command.
Examples
The following is sample output from the show pim traffic command:
hostname# show pim trafficPIM Traffic CountersElapsed time since counters cleared: 3d06hReceived SentValid PIM Packets 0 9485Hello 0 9485Join-Prune 0 0Register 0 0Register Stop 0 0Assert 0 0Bidir DF Election 0 0Errors:Malformed Packets 0Bad Checksums 0Send Errors 0Packet Sent on Loopback Errors 0Packets Received on PIM-disabled Interface 0Packets Received with Unknown PIM Version 0Related Commands
show pim tunnel
To display information about the PIM tunnel interfaces, use the show pim tunnels command in user EXEC or privileged EXEC mode.
show pim tunnels [if_name]
Syntax Description
if_name
(Optional) The name of an interface. Including this argument limits the displayed information to the specified interface.
Defaults
If an interface is not specified, this command shows the PIM tunnel information for all interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC or privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
PIM register packets are sent through the virtual encapsulation tunnel interface from the source first hop DR router to the RP. On the RP, a virtual decapsulation tunnel is used to represent the receiving interface of the PIM register packets. This command displays tunnel information for both types of interfaces.
Register tunnels are the encapsulated (in PIM register messages) multicast packets from a source that is sent to the RP for distribution through the shared tree. Registering applies only to SM, not SSM and bidirectional PIM.
Examples
The following is sample output from the show pim tunnel command:
hostname# show pim tunnelInterface RP Address Source AddressEncapstunnel0 10.1.1.1 10.1.1.1Decapstunnel0 10.1.1.1 -
show priority-queue statistics
To display the priority-queue statistics for an interface, use the show priority-queue statistics command in privileged EXEC mode.
show priority-queue statistics [interface-name]
Syntax Description
interface-name
(Optional) Specifies the name of the interface for which you want to show the best-effort and low-latency queue details.
Defaults
If you omit the interface name, this command shows priority-queue statistics for all configured interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
This example shows the use of the show priority-queue statistics command for the interface named test, and the command output. In this output, BE indicates the best-effort queue, and LLQ represents the low-latency queue:
hostname# show priority-queue statistics testPriority-Queue Statistics interface testQueue Type = BEPackets Dropped = 0Packets Transmit = 0Packets Enqueued = 0Current Q Length = 0Max Q Length = 0Queue Type = LLQPackets Dropped = 0Packets Transmit = 0Packets Enqueued = 0Current Q Length = 0Max Q Length = 0hostname#Related Commands
show processes
To display a list of the processes that are running on the security appliance, use the show processes command in privileged EXEC mode.
show processes [cpu-hog | memory | internals]
Defaults
By default this command displays the processes running on the security appliance.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
·
Command History
Usage Guidelines
The show processes command allows you to display a list of the processes that are running on the security appliance.
The command can also help determine what process is using the CPU, with the optional cpu-hog argument. A process is flagged if it is hogging the CPU for more than 100 milliseconds. The show process cpu-hog command displays the following columns when invoked:
•
•
•
Processes are lightweight threads requiring only a few instructions. In the listing, PC is the program counter, SP is the stack pointer, STATE is the address of a thread queue, Runtime is the number of milliseconds that the thread has been running based on CPU clock cycles, SBASE is the stack base address, Stack is the current number of bytes that are used and the total size of the stack, and Process lists the thread's function.
The optional memory argument displays the memory allocated by each process, to help track memory usage by process.
The optional internals argument displays the number of invoked calls and giveups. Invoked is the number of times the scheduler has invoked, or ran, the process. Giveups is the number of times the process yielded the CPU back to the scheduler.
Examples
This example shows how to display a list of processes that are running on the security appliance:
hostname(config)# show processesPC SP STATE Runtime SBASE Stack ProcessHsi 00102aa0 0a63f288 0089b068 117460 0a63e2d4 3600/4096 arp_timerLsi 00102aa0 0a6423b4 0089b068 10 0a64140c 3824/4096 FragDBGCHwe 004257c8 0a7cacd4 0082dfd8 0 0a7c9d1c 3972/4096 udp_timerLwe 0011751a 0a7cc438 008ea5d0 20 0a7cb474 3560/4096 dbgtrace<--- More --->hostname(config)# show processes cpuMAXHOG NUMHOG LASTHOG Process-------------- --------------- --------------- ---------7720 4 110 Dispatch Unit7870 331 1010 Checkheaps(other lines deleted for brevity)6170 1 6170 CTM message handlehostname(config)# show processes memory
------------------------------------------------------------
Allocs Allocated Frees Freed Process
(bytes) (bytes)
------------------------------------------------------------
23512 13471545 6 180 *System Main*
0 0 0 0 lu_rx
2 8324 16 19488 vpnlb_thread
(other lines deleted for brevity)
hostname# sho proc internals
Invoked Giveups Process
1 0 block_diag
19108445 19108445 Dispatch Unit
1 0 CF OIR
1 0 Reload Control Thread
1 0 aaa
2 0 CMGR Server Process
1 0 CMGR Timer Process
2 0 dbgtrace
69 0 557mcfix
19108019 19108018 557poll
2 0 557statspoll
1 0 Chunk Manager
135 0 PIX Garbage Collector
6 0 route_process
1 0 IP Address Assign
1 0 QoS Support Module
1 0 Client Update Task
8973 8968 Checkheaps
6 0 Session Manager
237 235 uauth
(other lines deleted for brevity)
show reload
To display the reload status on the security appliance, use the show reload command in privileged EXEC mode.
show reload
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
This command has no usage guidelines.
Examples
The following example shows that a reload is scheduled for 12:00 a.m. (midnight) on Saturday, April 20:
hostname# show reloadReload scheduled for 00:00:00 PDT Sat April 20 (in 12 hours and 12 minutes)Related Commands
show resource types
To view the resource types for which the security appliance tracks usage, use the show resource types command in privileged EXEC mode.
show resource types
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
The following sample display shows the resource types:
hostname# show resource typesAbsolute limit types:Conns ConnectionsHosts HostsIPSec IPSec Mgmt TunnelsSSH SSH SessionsTelnet Telnet SessionsXlates XLATE ObjectsAll All ResourcesRelated Commands
clear resource usage
Clears the resource usage statistics
context
Adds a security context.
show resource usage
Shows the resource usage of the security appliance.
show resource usage
To view the resource usage of the security appliance or for each context in mutliple mode, use the show resource usage command in privileged EXEC mode.
show resource usage [context context_name | top n | all | summary | system] [resource {resource_name | all}] [counter counter_name [count_threshold]]
Syntax Description
Defaults
For multiple context mode, the default context is all, which shows resource usage for every context. For single mode, the context name is ignored and the output shows the "context" as "System."
The default resource name is all, which shows all resource types.
The default counter name is all, which shows all statistics.
The default count threshold is 1.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
The following is sample output from the show resource usage context command, which shows the resource usage for the admin context:
hostname# show resource usage context adminResource Current Peak Limit ContextTelnet 1 1 5 adminConns 44 55 N/A adminHosts 45 56 N/A adminThe following is sample output from the show resource usage summary command, which shows the resource usage for all contexts and all resources. This sample shows the limits for 6 contexts.
hostname# show resource usage summaryResource Current Peak Limit ContextTelnet 3 5 30 SummarySSH 5 7 30 SummaryConns 40 55 N/A SummaryHosts 44 56 N/A SummaryThe following is sample output from the show resource usage summary command, which shows the limits for 25 contexts. Because the context limit for Telnet and SSH connections is 5 per context, then the combined limit is 125. The system limit is only 100, so the system limit is shown.
hostname# show resource usage summaryResource Current Peak Limit ContextTelnet 1 1 100[S] SummarySSH 2 2 100[S] SummaryConns 56 90 N/A SummaryHosts 89 102 N/A SummaryS = System limit: Combined context limits exceed the system limit; the system limit is shown.The following is sample output from the show resource usage system command, which shows the resource usage for all contexts, but it shows the system limit instead of the combined context limits:
hostname# show resource usage systemResource Current Peak Limit ContextTelnet 3 5 100 SystemSSH 5 7 100 SystemConns 40 55 N/A SystemHosts 44 56 N/A SystemRelated Commands
clear resource usage
Clears the resource usage statistics
context
Adds a security context.
show resource types
Shows a list of resource types.
show route
To display a default or static route for an interface, use the show route command in privileged EXEC mode.
show route [interface_name ip_address netmask gateway_ip]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following is sample output from the show route command:
hostname(config)# show routeC 10.30.10.0 255.255.255.0 is directly connected, outsideC 10.40.10.0 255.255.255.0 is directly connected, insideC 192.168.2.0 255.255.255.0 is directly connected, faillinkC 192.168.3.0 255.255.255.0 is directly connected, statelinkRelated Commands
show run fips
To verify the FIPS system location, system contact, and so forth, use the show run fips command.
show run fips
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
—
•
•
Command History
Usage Guidelines
The show run fips command displays information about the system configuration.
Examples
sw8-ASA(config)# show run fipsRelated Commands
show running-config
To display the configuration that is running on the security appliance, use the show running-config command in privileged EXEC mode.
show running-config [all] [command]
Syntax Description
all
Displays the entire operating configuration, including defaults.
command
Displays the configuration associated with a specific command.
Defaults
If no arguments or keywords are specified, the entire non-default security appliance configuration displays.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show running-config command displays the current running configuration on the security appliance.
You can use the running-config keyword only in the show running-config command. You cannot use this keyword with no or clear, or as a standalone command, because the CLI treats it as a nonsupported command. When you enter the ?, no ?, or clear ? keywords, a running-config keyword is not listed in the command list.
Note
Examples
This example show how to display the configuration that is running on the security appliance:
hostname# show running-config: Saved:XXX Version X.X(X)names!interface Ethernet0nameif testsecurity-level 10ip address 10.10.88.50 255.255.255.254!interface Ethernet1nameif insidesecurity-level 100ip address 10.86.194.176 255.255.254.0!interface Ethernet2shutdownno nameifsecurity-level 0no ip address!interface Ethernet3shutdownno nameifsecurity-level 0no ip address!interface Ethernet4shutdownno nameifsecurity-level 0no ip address!interface Ethernet5shutdownno nameifsecurity-level 0no ip address!enable password 8Ry2YjIyt7RRXU24 encryptedpasswd 2KFQnbNIdI.2KYOU encryptedhostname XXXdomain-name XXX.comboot system flash:/cdisk.binftp mode passivepager lines 24mtu test 1500mtu inside 1500monitor-interface testmonitor-interface insideASDM image flash:ASDMno ASDM history enablearp timeout 14400route inside 0.0.0.0 0.0.0.0 10.86.194.1 1timeout xlate 3:00:00timeout conn 2:00:00 half-closed 1:00:00 udp 0:02:00 icmp 1:00:00 rpc 1:00:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00timeout uauth 0:00:00 absolutehttp server enablehttp 0.0.0.0 0.0.0.0 insideno snmp-server locationno snmp-server contactsnmp-server enable traps snmpfragment size 200 testfragment chain 24 testfragment timeout 5 testfragment size 200 insidefragment chain 24 insidefragment timeout 5 insidetelnet 0.0.0.0 0.0.0.0 insidetelnet timeout 1440ssh timeout 5console timeout 0group-policy todd internal!class-map inspection_defaultmatch default-inspection-traffic!!policy-map xxx_global_fw_policyclass inspection_defaultinspect dnsinspect ftpinspect h323 h225inspect h323 rasinspect httpinspect ilsinspect mgcpinspect netbiosinspect rpcinspect rshinspect rtspinspect sipinspect skinnyinspect sqlnetinspect tftpinspect xdmcpinspect ctiqbeinspect cuseemeinspect icmp!terminal width 80service-policy xxx_global_fw_policy globalCryptochecksum:bfecf4b9d1b98b7e8d97434851f57e14: endRelated Commands
show running-config aaa
To show the AAA configuration in the running configuration, use the show running-config aaa command in privileged EXEC mode.
show running-config aaa [ accounting | authentication | authorization | mac-exempt | proxy-limit ]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config aaa command:
hostname# show running-config aaaaaa authentication match infrastructure_authentication_radiusvrs infrastructure radiusvrsaaa accounting match infrastructure_authentication_radiusvrs infrastructure radiusvrsaaa authentication secure-http-clientaaa local authentication attempts max-fail 16Related Commands
show running-config aaa-server
To display AAA server configuration, use the show running-config aaa-server command in privileged EXEC mode.
show running-config [all] aaa-server [server-tag] [(interface-name)] [host hostname]
Syntax Description
Defaults
Omitting the server-tag value displays the configurations for all AAA servers.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Usage Guidelines
Use this command to display the settings for a particular server group. Use the all parameter to display the default as well as the explicitly configured values.
Examples
To display the running configuration for the default AAA server group, use the following command:
hostname(config)# show running-config default aaa-serveraaa-server group1 protocol tacacs+ accounting-mode simultaneousreactivation-mode depletion deadtime 10
max-failed-attempts 4
Related Commands
show aaa-server
Displays AAA server statistics.
clear configure aaa-server
Clears the AAA server configuration.
show running-config aaa-server host
To display AAA server statistics for a particular server, use the show running-config aaa-server command in global configuration or privileged EXEC mode.
show/clear aaa-server
show running-config [all] aaa-server server-tag [(interface-name)] host hostname
Syntax Description
all
(Optional) Shows the running configuration, including default configuration values.
server-tag
The symbolic name of the server group.
Defaults
Omitting the default keyword displays only the explicitly configured configuration values, not the default values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Global configuration
•
•
—
—
•
Command History
Usage Guidelines
Use this command to display the statistics for a particular server group. Use the default parameter to display the default as well as the explicitly configured values.
Examples
To display the running configuration for the server group svrgrp1, use the following command:
hostname(config)# show running-config default aaa-server svrgrp1Related Commands
show running-config access-group
To display the access group information, use the show running-config access-group command in privileged EXEC mode.
show running-config access-group
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config access-group command:
hostname# show running-config access-groupaccess-group 100 in interface outsideRelated Commands
access-group
Binds an access list to an interface.
clear configure access-group
Removes access groups from all the interfaces.
show running-config access-list
To display the access-list configuration that is running on the security appliance, use the show running-config access-list command in privileged EXEC mode.
show running-config [default] access-list [alert-interval | deny-flow-max]
show running-config [default] access-list id [saddr_ip]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show running-config access-list command allows you to display the current running access list configuration on the security appliance.
Examples
The following is sample output from the show running-config access-list command:
hostname# show running-config access-listaccess-list allow-all extended permit ip any anyRelated Commands
show running-config alias
To display the overlapping addresses with dual NAT commands in the configuration, use the show running-config alias command in privileged EXEC mode.
show running-config alias {interface_name}
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
•
•
Command History
Examples
This example shows how to display alias information:
hostname# show running-config aliasRelated Commands
show running-config arp
To show static ARP entries created by the arp command in the running configuration, use the show running-config arp command in privileged EXEC mode.
show running-config arp
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config arp command:
hostname# show running-config arparp inside 10.86.195.11 0008.023b.9893Related Commands
show running-config arp timeout
To view the ARP timeout configuration in the running configuration, use the show running-config arp timeout command in privileged EXEC mode.
show running-config arp timeout
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config arp timeout command:
hostname# show running-config arp timeoutarp timeout 20000 secondsRelated Commands
show running-config arp-inspection
To view the ARP inspection configuration in the running configuration, use the show running-config arp-inspection command in privileged EXEC mode.
show running-config arp-inspection
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
—
Command History
Examples
The following is sample output from the show running-config arp-inspection command:
hostname# show running-config arp-inspectionarp-inspection inside1 enable no-floodRelated Commands
show running-config asdm
To display the asdm commands in the running configuration, use the show running-config asdm command in privileged EXEC mode.
show running-config asdm [group | location]
Syntax Description
group
(Optional) Limits the display to the asdm group commands in the running configuration.
location
(Optional) Limits the display to the asdm location commands in the running configuration.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
7.0
This command was changed from the show running-config pdm command to the show running-config asdm command.
Usage Guidelines
To remove the asdm commands from the configuration, use the clear configure asdm command.
Note
Examples
The following is sample output from the show running-configuration asdm command:
hostname# show running-config asdmasdm image flash:/ASDMasdm history enablehostname#Related Commands
show running-config auth-prompt
To displays the current authentication prompt challenge text, use the show running-config auth-prompt command in global configuration mode.
show running-config [default] auth-prompt
Syntax Description
Defaults
Display the configured authentication prompt challenge text.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
—
•
Command History
Usage Guidelines
After you configure the authentication prompt with the auth-prompt command, use the show running-config auth-prompt command to view the current prompt text.
Examples
The following example shows the output of the show running-config auth-prompt command:
hostname(config)# show running-config auth-promptauth-prompt prompt Please login:auth-prompt accept You're in!auth-prompt reject Try again.Related Commands
auth-prompt
Set the user authorization prompts.
clear configure auth-prompt
Reset the user authorization prompts to the default value.
show running-config banner
To display the specified banner and all the lines that are configured for it, use the show running-config banner command in privileged EXEC mode.
show running-config banner [exec | login | motd]
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show running-config banner command displays the specified banner keyword and all the lines configured for it. If a keyword is not specified, then all banners display.
Examples
This example shows how to display the message-of-the-day (motd) banner:
hostname# show running-config banner motdRelated Commands
show running-config class-map
To display the information about the class map configuration, use the show running-config class-map command in privileged EXEC mode.
show running-config [all] class-map [class_map_name]
Syntax Description
all
(Optional) Show all running class map configuration, including default.
class_map_name
(Optional) Text for the class map name; the text can be up to 40 characters in length.
Defaults
The class-map class-default command, which contains a single match any command is the default class map.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config class-map command:
hostname# show running-config class-mapclass-map tcp-portmatch port tcp eq ftpRelated Commands
class-map
Applies a traffic class to an interface.
clear configure class-map
Removes all of the traffic map definitions.
show running-config clock
To show the clock configuration in the running configuration, use the show running-config clock command in privileged EXEC mode.
show running-config [all] clock
Syntax Description
all
(Optional) Shows all clock commands, including the commands you have not changed from the default.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
The all keyword also displays the exact day and time for the clock summer-time command, as well as the default setting for the offset, if you did not originally set it.
Examples
The following is sample output from the show running-config clock command. Only the clock summer-time command was set.
hostname# show running-config clockclock summer-time EDT recurringThe following is sample output from the show running-config all clock command. The default setting for the unconfigured clock timezone command displays, and the detailed information for the clock summer-time command displays.
hostname# show running-config all clockclock timezone UTC 0clock summer-time EDT recurring 1 Sun Apr 2:00 last Sun Oct 2:00 60Related Commands
clock set
Manually sets the clock on the security appliance.
clock summer-time
Sets the date range to show daylight saving time.
clock timezone
Sets the time zone.
show running-config command-alias
To display the command aliases that are configured, use the show running-config command-alias command in privileged EXEC mode.
show running-config [all] command-alias
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
If you do not enter the all keyword, only non-default command aliases display.
Examples
The following example displays all command aliases that are configured on the security appliance, including defaults:
hostname# show running-config all command-aliascommand-alias exec h helpcommand-alias exec lo logoutcommand-alias exec p pingcommand-alias exec s showcommand-alias exec save copy running-config startup-configThe following example displays all command aliases that are configured on the security appliance, excluding defaults:
hostname# show running-config command-aliascommand-alias exec save copy running-config startup-confighostname#Related Commands
command-alias
Creates a command alias.
clear configure command-alias
Deletes all non-default command aliases.
show running-config console timeout
To display the console connection timeout value, use the show running-config console timeout command in privileged EXEC mode.
show running-config console timeout
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following example shows how to display the console connection timeout setting:
hostname# show running-config console timeoutconsole timeout 0Related Commands
console timeout
Sets the idle timeout for a console connection to the security appliance.
clear configure console
Resets the console connection settings to defaults.
show running-config context
To show the context configuration in the system execution space, use the show running-config context command in privileged EXEC mode.
show running-config context
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Examples
The following is sample output from the show running-config context command:
hostname# show running-config contextadmin-context admincontext adminallocate-interface GigabitEthernet0/0config-url flash:/admin.cfg!context Aallocate-interface GigabitEthernet0/1config-url flash:/A.cfg!Related Commands
show running-config crypto
To display the entire crypto configuration including IPSec, crypto maps, dynamic crypto maps, and ISAKMP, use the show running-config crypto command in global configuration or privileged EXEC mode.
show running-config crypto
Syntax Description
This command has no keywords or arguments.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
Command History
Examples
The following example entered in privileged EXEC mode, displays all crypto configuration information:
hostname# show running-config crypto mapcrypto map abc 1 match address xyzcrypto map abc 1 set peer 209.165.200.225crypto map abc 1 set transform-set tttcrypto map abc interface testisakmp enable insideisakmp policy 1 authentication pre-shareisakmp policy 1 encryption 3desisakmp policy 1 hash md5isakmp policy 1 group 2isakmp policy 1 lifetime 86400hostname#Related Commands
show running-config crypto dynamic-map
To view a dynamic crypto map, use the show running-config crypto dynamic-map command in global configuration or privileged EXEC mode.
show running-config crypto dynamic-map
Syntax Description
This command has no keywords or arguments.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following example entered in global configuration mode, displays all configuration information about crypto dynamic maps:
hostname(config)# show running-config crypto dynamic-mapCrypto Map Template "dyn1" 10access-list 152 permit ip host 172.21.114.67 anyCurrent peer: 0.0.0.0Security association lifetime: 4608000 kilobytes/120 secondsPFS (Y/N): NTransform sets={ tauth, t1, }hostname(config)#Related Commands
show running-config crypto ipsec
To display the complete IPSec configuration, use the show running-config crypto ipsec command in global configuration or privileged EXEC mode.
show running-config crypto ipsec
Syntax Description
This command has no default behavior or values.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
Command History
Examples
The following example issued in global configuration mode, displays information about the IPSec configuration:
hostname(config)# show running-config crypto ipseccrypto ipsec transform-set ttt esp-3des esp-md5-hmachostname(config)#Related Commands
show running-config crypto isakmp
To display the complete ISAKMP configuration, use the show running-config crypto isakmp command in global configuration or privileged EXEC mode.
show running-config crypto isakmp
Syntax Description
This command has no default behavior or values.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
Command History
Examples
The following example issued in global configuration mode, displays information about the ISKAKMP configuration:
hostname<config># show running-config crypto isakmpisakmp enable insideisakmp policy 1 authentication pre-shareisakmp policy 1 encryption 3desisakmp policy 1 hash md5isakmp policy 1 group 2isakmp policy 1 lifetime 86400hostname<config>#Related Commands
show running-config crypto map
To display all configuration for all crypto maps, use the show running-config crypto map command in global configuration or privileged EXEC mode.
show running-config crypto map
Syntax Description
This command has no keywords or arguments.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Privileged EXEC
•
•
•
—
—
Command History
Examples
The following example entered in privileged EXEC mode, displays all configuration information for all crypto maps:
hostname# show running-config crypto mapcrypto map abc 1 match address xyzcrypto map abc 1 set peer 209.165.200.225crypto map abc 1 set transform-set tttcrypto map abc interface testhostname#Related Commands
show running-config dhcpd
To show the DHCP configuration, use the show running-config dhcpd command in privileged EXEC or global configuration mode.
show running-config dhcpd
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
7.0
This command was changed from the show dhcpd command to the show running-config dhcpd command.
Usage Guidelines
The show running-config dhcpd command displays the DHCP commands entered in the running configuration. To see DHCP binding, state, and statistical information, use the show dhcpd command.
Examples
The following is sample output from the show running-config dhcpd command:
hostname# show running-config dhcpddhcpd address 10.0.1.100-10.0.1.108 insidedhcpd lease 3600dhcpd ping_timeout 750dhcpd dns 209.165.201.2 209.165.202.129dhcpd enable insideRelated Commands
show running-config dhcprelay
To view the current DHCP relay agent configuration, use the show running-config dhcprelay command in privileged EXEC mode.
show running-config dhcprelay
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
The show running-config dhcprelay command displays the current DHCP relay agent configuration. To show DHCP relay agent packet statistics, use the show dhcprelay statistics command.
Examples
The following example shows output from the show running-config dhcprelay command:
hostname(config)# show running-config dhcprelaydhcprelay server 10.1.1.1dhcprelay enable insidedhcprelay timeout 90Related Commands
show running-config dns
To show the DNS configuration in the running configuration, use the show running-config dns command in privileged EXEC mode.
show running-config dns
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config dns command:
hostname# show running-config dnsdns domain-lookup insidedns name-serverdns retries 2dns timeout 15dns name-server 10.1.1.1Related Commands
show running-config domain-name
To show the domain name configuration in the running configuration, use the show running-config domain-name command in privileged EXEC mode.
show running-config domain-name
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following is sample output from the show running-config domain-name command:
hostname# show running-config domain-nameexample.comRelated Commands
domain-name
Sets the default domain name.
hostname
Sets the security appliance hostname.
show running-config enable
To show the encrypted enable passwords, use the show running-config enable command in privileged EXEC mode.
show running-config enable
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The password is saved to the configuration in encrypted form, so you cannot view the original password after you enter it. The password displays with the encrypted keyword to indicate that the password is encrypted.
Examples
The following is sample output from the show running-config enable command:
hostname# show running-config enableenable password 2AfK9Kjr3BE2/J2r level 10 encryptedenable password 8Ry2YjIyt7RRXU24 encryptedRelated Commands
disable
Exits privileged EXEC mode.
enable
Enters privileged EXEC mode.
enable password
Sets the enable password.
show running-config established
To display the allowed inbound connections that are based on established connections, use the show running-config established command in privileged EXEC mode.
show running-config established
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
This command has no usage guidelines.
Examples
This example shows how to display inbound connections that are based on established connections:
hostname# show running-config establishedRelated Commands
established
Permits return connections on ports that are based on an established connection.
clear configure established
Removes all established commands.
show running-config failover
To display the failover commands in the configuration, use the show running-config failover command in privileged EXEC mode.
show running-config [all] failover
Syntax Description
all
(Optional) Shows all failover commands, including the commands you have not changed from the default.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
The show running-config failover command displays the failover commands in the running configuration. It does not display the monitor-interface or join-failover-group commands.
Examples
The following example shows the default failover configuration before failover has been configured:
hostname# show running-config all failoverno failoverfailover lan unit secondaryfailover polltime unit 15 holdtime 45failover polltime interface 15failover interface policy 1hostname#Related Commands
show running-config filter
To show the filtering configuration, use the show running-config filter command in privileged EXEC mode.
show running-config filter
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show running-config filter command displays the filtering configuration for the security appliance.Examples
The following is sample output from the show running-config filter command, and shows the filtering configuration for the security appliance:
hostname# show running-config filter!filter activex 80 10.86.194.170 255.255.255.255 10.1.1.0 255.255.255.224!This example shows ActiveX filtering is enabled on port80 for the address 10.86.194.170.
Related Commands
show running-config fips
To display the FIPS configuration that is running on the security appliance, use the show running-config fips command.
show running-config fips
Syntax Description
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
The show running-config fips command allows you to display the current running fips configuration. You use the running-config keyword only in the show running-config fips command. You cannot use this keyword with no or clear, or as a standalone command as it is not supported. When you enter the ?, no ?, or clear ? keywords, a running-config keyword is not listed in the command list.
Examples
sw8-ASA(config)# show running-config fipsRelated Commands
show running-config fragment
To display the current configuration of the fragment databases, use the show running-config fragment command in privileged EXEC mode.
show running-config fragment [interface]
Syntax Description
Defaults
If an interface is not specified, the command applies to all interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show running-config fragment command displays the current configuration of the fragment databases. If you specify an interface name, only information for the database residing at the specified interface displays. If you do not specify an interface name, the command applies to all interfaces.
Use the show running-config fragment command to display this information:
•
•
•
Examples
The following example shows how to display the states of the fragment databases on all interfaces:
hostname# show running-config fragmentfragment size 200 insidefragment chain 24 insidefragment timeout 5 insidefragment size 200 outside1fragment chain 24 outside1fragment timeout 5 outside1fragment size 200 outside2fragment chain 24 outside2fragment timeout 5 outside2fragment size 200 outside3fragment chain 24 outside3fragment timeout 5 outside3The following example shows how to display the states of the fragment databases on interfaces that start with the name "outside":
Note
hostname# show running-config fragment outsidefragment size 200 outside1fragment chain 24 outside1fragment timeout 5 outside1fragment size 200 outside2fragment chain 24 outside2fragment timeout 5 outside2fragment size 200 outside3fragment chain 24 outside3fragment timeout 5 outside3The following example shows how to display the states of the fragment databases on the interfaces named "outside1" only:
hostname# show running-config fragment outside1fragment size 200 outside1fragment chain 24 outside1fragment timeout 5 outside1Related Commands
show running-config ftp-map
To show the FTP maps that have been configured, use the show running-config ftp-map command in privileged EXEC mode.
show running-config ftp-map map_name
Syntax Description
.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show running-config ftp-map command displays the FTP maps that have been configured.Examples
The following is sample output from the show running-config ftp-map command:
hostname# show running-config ftp-map ftp-policy!ftp-map ftp-policyrequest-command deny put stou appe!Related Commands
show running-config ftp mode
To show the client mode configured for FTP, use the show running-config ftp mode command in privileged EXEC mode.
show running-config ftp mode
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show running-config ftp mode command displays the client mode that is used by the security appliance when accessing an FTP server.Examples
The following is sample output from the show running-config ftp-mode command:
hostname# show running-config ftp-mode!ftp-mode passive!Related Commands
show running-config global
To display the global commands in the configuration, use the show running-config global command in privileged EXEC mode.
show running-config global
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Examples
The following is sample output from the show running-config global command:
hostname# show running-config globalglobal (outside1) 10 interfaceRelated Commands
clear configure global
Removes global commands from the configuration.
global
Creates entries from a pool of global addresses.
show running-config group-delimiter
To display the current delimiter to be used when parsing group names from the user names that are received when tunnels are being negotiated, use the show running-config group-delimiter command in global configuration mode.
show running-config group-delimiter
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
—
•
Command History
Usage Guidelines
Use this command to display the currently configured group-delimiter.
Examples
This example shows a show running-config group-delimiter command and its output:
hostname(config)# show running-config group-delimitergroup-delimiter @Related Commands
group-delimiter
Enables group-name parsing and specifies the delimiter to be used when parsing group names from the user names that are received when tunnels are being negotiated.
show running-config group-policy
To display the running configuration for a particular group policy, use the show running-config group-policy command in privileged EXEC mode and append the name of the group policy. To display the running configuration for all group policies, use this command without naming a specific group policy. To have either display include the default configuration, use the default keyword.
show running-config [default] group-policy [name]
Syntax Description
default
Displays the running configuration including default values.
name
Specifies the name of the group policy.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Global configuration
•
—
•
—
—
Command History
Examples
The following example shows how to display the running configuration, including default values, for the group policy named FirstGroup:
hostname# show running-config default group-policy FirstGroupRelated Commands
show running-config gtp-map
To show the GTP maps that have been configured, use the show running-config gtp-map command in privileged EXEC mode.
show running-config gtp-map map_name
Syntax Description
.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show running-config gtp-map command displays the GTP maps that have been configured.Examples
The following is sample output from the show running-config gtp-map command:
hostname# show running-config gtp-map gtp-policy!gtp-map gtp-policyrequest-queue 300message-length min 20 max 300drop message 20tunnel-limit 10000!Related Commands
show running-config http
To display the current set of configured http commands, use the show running-config http command in privileged EXEC mode.
show running-config http
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Global configuration
•
—
•
—
—
Command History
Usage Guidelines
Examples
The following sample output shows how to use the show running-config http command:
hostname# show running-config httphttp server enabled0.0.0.0 0.0.0.0 insideRelated Commands
show running-config http-map
To show the HTTP maps that have been configured, use the show running-config http-map command in privileged EXEC mode.
show running-config http-map map_name
Syntax Description
.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show running-config http-map command displays the HTTP maps that have been configured.Examples
The following is sample output from the show running-config http-map command:
hostname# show running-config http-map http-policy!http-map http-policycontent-length min 100 max 2000 action reset logcontent-type-verification match-req-rsp reset logmax-header-length request bytes 100 action log resetmax-uri-length 100 action reset log!Related Commands
show running-config icmp
To show the access rules configured for ICMP traffic, use the show running-config icmp command in privileged EXEC mode.
show running-config icmp map_name
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show running-config icmp command displays the access rules configured for ICMP traffic.Examples
The following is sample output from the show running-config icmp command:
hostname# show running-config icmp!icmp permit host 172.16.2.15 echo-reply outsideicmp permit 172.22.1.0 255.255.0.0 echo-reply outsideicmp permit any unreachable outside!Related Commands
show running-config imap4s
To display the running configuration for IMAP4S, use the show running-config imap4s command in privileged EXEC mode.
show running-config [all] imap4s
Syntax Description
Defaults
No default behavior or values.
Command History
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Examples
The following is sample output from the show running-config imap4s command:
hostname# show running-config imap4simap4sserver 10.160.105.2authentication-server-group KerbSvrauthentication aaahostname# show running-config all imap4simap4sport 993server 10.160.105.2outstanding 20name-separator :server-separator @authentication-server-group KerbSvrno authorization-server-groupno accounting-server-groupno default-group-policyauthentication aaaRelated Commands
clear configure imap4s
Removes the IMAP4S configuration.
imap4s
Creates or edits an IMAP4S e-mail proxy configuration.
show running-config interface
To show the interface configuration in the running configuration, use the show running-config interface command in privileged EXEC mode.
show running-config [all] interface [physical_interface[.subinterface] | mapped_name | interface_name]
Syntax Description
Defaults
If you do not specify an interface, this command shows the configuration for all interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
You cannot use the interface name in the system execution space, because the nameif command is only available within a context. Similarly, if you mapped the interface ID to a mapped name using the allocate-interface command, you can only use the mapped name in a context.
Examples
The following is sample output from the show running-config interface command. The following example shows the running configuration for all interfaces. The GigabitEthernet0/2 and 0/3 interfaces have not been configured yet, and show the default configuration. The Management0/0 interface also shows the default settings.
formula_1# show running-config interface!interface GigabitEthernet0/0nameif insidesecurity-level 100ip address 10.86.194.60 255.255.254.0webvpn enable!interface GigabitEthernet0/1shutdownnameif testsecurity-level 0ip address 10.10.4.200 255.255.0.0!interface GigabitEthernet0/2shutdownno nameifsecurity-level 0no ip address!interface GigabitEthernet0/3shutdownno nameifsecurity-level 0no ip address!interface Management0/0shutdownno nameifsecurity-level 0no ip addressRelated Commands
show running-config ip address
To show the IP address configuration in the running configuration, use the show running-config ip address command in privileged EXEC mode.
show running-config ip address [physical_interface[.subinterface] | mapped_name | interface_name]
Syntax Description
Defaults
If you do not specify an interface, this command shows the IP address configuration for all interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
In multiple context mode, if you mapped the interface ID in the allocate-interface command, you can only specify the mapped name or the interface name in a context.
In transparent firewall mode, do not specify an interface because this command shows only the management IP address; the transparent firewall does not have IP addresses associated with interfaces.
This display also shows the nameif command and security-level command configuration.
Examples
The following is sample output from the show running-config ip address command:
hostname# show running-config ip address!interface GigabitEthernet0/0nameif insidesecurity-level 100ip address 10.86.194.60 255.255.254.0!interface GigabitEthernet0/1nameif testsecurity-level 0ip address 10.10.4.200 255.255.0.0!Related Commands
show running-config ip audit attack
To show the ip audit attack configuration in the running configuration, use the show running-config ip audit attack command in privileged EXEC mode.
show running-config ip audit attack
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config ip audit attack command:
hostname# show running-config ip audit attackip audit attack action dropRelated Commands
show running-config ip audit info
To show the ip audit info configuration in the running configuration, use the show running-config ip audit info command in privileged EXEC mode.
show running-config ip audit info
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config ip audit info command:
hostname# show running-config ip audit infoip audit info action dropRelated Commands
show running-config ip audit interface
To show the ip audit interface configuration in the running configuration, use the show running-config ip audit interface command in privileged EXEC mode.
show running-config ip audit interface [interface_name]
Syntax Description
Defaults
If you do not specify an interface name, this command shows the configuration for all interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config ip audit interface command:
hostname# show running-config ip audit interfaceip audit interface inside insidepolicyip audit interface outside outsidepolicyRelated Commands
show running-config ip audit name
To show the ip audit name configuration in the running configuration, use the show running-config ip audit name command in privileged EXEC mode.
show running-config ip audit name [name [info | attack]]
Syntax Description
Defaults
If you do not specify a name, this command shows the configuration for all audit policies.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config ip audit name command:
hostname# show running-config ip audit nameip audit name insidepolicy1 attack action alarmip audit name insidepolicy2 info action alarmip audit name outsidepolicy1 attack action resetip audit name outsidepolicy2 info action alarmRelated Commands
show running-config ip audit signature
To show the ip audit signature configuration in the running configuration, use the show running-config ip audit signature command in privileged EXEC mode.
show running-config ip audit signature [signature_number]
Syntax Description
signature_number
(Optional) Shows the configuration for the signature number, if present. See the ip audit signature command for a list of supported signatures.
Defaults
If you do not specify a number, this command shows the configuration for all signatures.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config ip audit signature command:
hostname# show running-config ip audit signatureip audit signature 1000 disableRelated Commands
show running-config ip local pool
To display IP address pools, use the show running-config ip local pool command in privileged EXEC mode.
show running-config ip local pool [poolname]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
EXEC
•
—
•
—
—
Global configuration
•
—
•
—
—
Command History
Examples
The following is sample output from the show running-config ip local pool command:
hostname(config)# show running-config ip local pool firstpoolPool Begin End Mask Free In usefirstpool 10.20.30.40 10.20.30.50 255.255.255.0 110Available Addresses:10.20.30.4010.20.30.4110.20.30.4210.20.30.4310.20.30.4410.20.30.4510.20.30.4610.20.30.4710.20.30.4810.20.30.4910.20.30.50hostname(config)#Related Commands
clear configure ip local pool
Removes all ip local pools
ip local pool
Configures an IP address pool.
show running-config ip verify reverse-path
To show the ip verify reverse-path configuration in the running configuration, use the show running-config ip verify reverse-path command in privileged EXEC mode.
show running-config ip verify reverse-path [interface interface_name]
Syntax Description
Defaults
This command shows the configuration for all interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
—
·
·
—
Command History
Examples
The following is sample output from the show ip verify statistics command:
hostname# show running-config ip verify reverse-pathip verify reverse-path interface insideip verify reverse-path interface outsideip verify reverse-path interface dmzRelated Commands
show running-config ipv6
To display the IPv6 commands in the running configuration, use the show running-config ipv6 command in privileged EXEC mode.
show running-config [all] ipv6
Syntax Description
all
(Optional) Shows all ipv6 commands, including the commands you have not changed from the default, in the running configuration.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Examples
The following is sample output from the show running-config ipv6 command:
hostname# show running-config ipv6ipv6 unicast-routingipv6 route vlan101 ::/0 fec0::65:0:0:a0a:6575ipv6 access-list outside_inbound_ipv6 permit ip any anyipv6 access-list vlan101_inbound_ipv6 permit ip any anyhostname#Related Commands
show running-config isakmp
To display the complete ISAKMP configuration, use the show running-config isakmp command in global configuration or privileged EXEC mode.
show running-config isakmp
Syntax Description
This command has no default behavior or values.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
Command History
Examples
The following example issued in global configuration mode, displays information about the ISKAKMP configuration:
hostname(config)# show running-config isakmpisakmp enable insideisakmp policy 1 authentication pre-shareisakmp policy 1 encryption 3desisakmp policy 1 hash md5isakmp policy 1 group 2isakmp policy 1 lifetime 86400hostname(config)#Related Commands
show running-config logging
To display all currently running logging configuration, use the show runnig-config logging command in privileged EXEC mode.
show running-config [all] logging [level | disabled]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following is an example of the show running-config logging disabled command:
hostname# show running-config logging disabledno logging message 720067Related Commands
logging message
Configures logging.
show logging
Shows the log buffer and other logging settings.
show logging rate-limit
To display the disallowed messages to the original set, use the show logging rate-limit command.
show logging rate-limit
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
After the information is cleared, nothing more displays until the hosts reestablish their connections.
Examples
This example shows how to display the disallowed messages:
hostname(config)# show logging rate-limitRelated Commands
show running-config mac-address-table
To view the mac-address-table static and mac-address-table aging-time configuration in the running configuration, use the show running-config mac-address-table command in privileged EXEC mode.
show running-config mac-address-table
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
—
Command History
Examples
The following is sample output from the show running-config mac-learn command:
hostname# show running-config mac-address-tablemac-address-table aging-time 50mac-address-table static inside1 0010.7cbe.6101Related Commands
show running-config mac-learn
To view the mac-learn configuration in the running configuration, use the show running-config mac-learn command in privileged EXEC mode.
show running-config mac-learn
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
—
Command History
Examples
The following is sample output from the show running-config mac-learn command:
hostname# show running-config mac-learnmac-learn disableRelated Commands
show running-config mac-list
To display a list of MAC addresses previously specified in a mac-list command with the indicated MAC list number, use the show running-config mac-list command in privileged EXEC mode.
show running-config mac-list id
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Usage Guidelines
The show running-config aaa command displays the mac-list command statements as part of the AAA configuration.
Examples
The following example shows how to display a MAC address list with the id equal to adc:
hostname(config)# show running-config mac-list adcmac-list adc permit 00a0.cp5d.0282 ffff.ffff.ffffmac-list adc deny 00a1.cp5d.0282 ffff.ffff.ffffmac-list ac permit 0050.54ff.0000 ffff.ffff.0000mac-list ac deny 0061.54ff.b440 ffff.ffff.ffffmac-list ac deny 0072.54ff.b440 ffff.ffff.ffffRelated Commands
show running-config management-access
To display the name of the internal interface configured for management access, use the show running-config management-access command in privileged EXEC mode.
show running-config management-access
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The management-access command lets you define an internal management interface using the IP address of the firewall interface specified in mgmt_if. (The interface names are defined by the nameif command and displayed in quotes, " ", in the output of the show interface command.)
Examples
The following example shows how to configure a firewall interface named "inside" as the management access interface and display the result:
hostname# management-access insidehostname# show running-config management-accessmanagement-access insideRelated Commands
show running-config mgcp-map
To show the MGCP maps that have been configured, use the show running-config mgcp-map command in privileged EXEC mode.
show running-config mgcp-map map_name
Syntax Description
.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show running-config mgcp-map command displays the MGCP maps that have been configured.Examples
The following is sample output from the show running-config mgcp-map command:
hostname# show running-config mgcp-map mgcp-policy!mgcp-map mgcp-policycall-agent 10.10.11.5 101call-agent 10.10.11.6 101call-agent 10.10.11.7 102call-agent 10.10.11.8 102gateway 10.10.10.115 101gateway 10.10.10.116 102gateway 10.10.10.117 102command-queue 150Related Commands
show running-config mroute
To display the static multicast route table in the configuration use the show running-config mroute command in privileged EXEC mode.
show running-config mroute [dst [src]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config mroute command:
hostname# show running-config mrouteRelated Commands
show running-config mtu
To display the current maximum transmission unit block size, use the show running-config mtu command in privileged EXEC mode.
show running-config mtu [interface_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
—
•
•
•
—
Command History
Examples
The following is sample output from the show running-config mtu command:
hostname# show running-config mtumtu outside 1500mtu inside 1500mtu dmz 1500hostname# show running-config mtu outsidemtu outside 1500Related Commands
clear configure mtu
Clears the configured maximum transmission unit values on all interfaces.
mtu
Specifies the maximum transmission unit for an interface.
show running-config multicast-routing
To display the multicast-routing command, if present, in the running configuration, use the show running-config multicast-routing command in privileged EXEC mode.
show running-config multicast-routing
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The show running-config multicast-routing command displays the multicast-routing command in the running configuration. Enter the clear configure multicast-routing command to remove the multicast-routing command from the running configuration.
Examples
The following is sample output from the show running-config multicast-routing command:
hostname# show running-config multicast-routingmulticast-routingRelated Commands
clear configure multicast-routing
Removes the multicast-routing command from the running configuration.
multicast-routing
Enables multicast routing on the security appliance.
show running-config name
To display a list of names associated with IP addresses (configured with the name command), use the show running-config name command in privileged EXEC mode.
show running-config name
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
This example shows how to display a list of names associated with IP addresses:
hostname# show running-config namename 192.168.42.3 sa_insidename 209.165.201.3 sa_outsideRelated Commands
clear configure name
Clears the list of names from the configuration.
name
Associates a name with an IP address.
show running-config nameif
To show the interface name configuration in the running configuration, use the show running-config nameif command in privileged EXEC mode.
show running-config nameif [physical_interface[.subinterface] | mapped_name]
Syntax Description
Defaults
If you do not specify an interface, this command shows the interface name configuration for all interfaces.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
In multiple context mode, if you mapped the interface ID in the allocate-interface command, you can only specify the mapped name in a context.
This display also shows the security-level command configuration.
Examples
The following is sample output from the show running-config nameif command:
hostname# show running-config nameif!interface GigabitEthernet0/0nameif insidesecurity-level 100!interface GigabitEthernet0/1nameif testsecurity-level 0!Related Commands
show running-config names
To display the IP address-to-name conversions, use the show running-config names command in privileged EXEC mode.
show running-config names
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Use with the names command.
Examples
The following example shows how to display the IP address-to-name conversion:
hostname# show running-config namesname 192.168.42.3 sa_insidename 209.165.201.3 sa_outsideRelated Commands
show running-config nat
To display a pool of global IP addresses that are associated with a network, use the show running-config nat command in privileged EXEC mode.
show running-config nat [interface_name] [nat_id]
Syntax Description
interface_name
(Optional) Name of the network interface.
nat_id
(Optional) ID of the group of host or networks.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
This command displays the maximum connection value for the UDP protocol. Every time the UPD maximum connection value is not set, the value will be displayed as 0 by default and will not be applied.
Note
Examples
This example shows how to display a pool of global IP addresses that are associated with a network:
hostname# show running-config natnat (inside) 1001 10.7.2.0 255.255.255.224 0 0nat (inside) 1001 10.7.2.32 255.255.255.224 0 0nat (inside) 1001 10.7.2.64 255.255.255.224 0 0nat (inside) 1002 10.7.2.96 255.255.255.224 0 0nat (inside) 1002 10.7.2.128 255.255.255.224 0 0nat (inside) 1002 10.7.2.160 255.255.255.224 0 0nat (inside) 1003 10.7.2.192 255.255.255.224 0 0nat (inside) 1003 10.7.2.224 255.255.255.224 0 0Related Commands
clear configure nat
Removes the NAT configuration.
nat
Associates a network with a pool of global IP addresses.
show running-config nat-control
To show the NAT configuration requirement, use the show running-config nat-control command in privileged EXEC mode.
show running-config nat-control
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Examples
The following is sample output from the show running-config nat-control command:
hostname# show running-config nat-controlno nat-controlRelated Commands
show running-config ntp
To show the NTP configuration in the running configuration, use the show running-config ntp command in privileged EXEC mode.
show running-config ntp
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Examples
The following is sample output from the show running-config ntp command:
hostname# show running-config ntpntp authentication-key 1 md5 test2ntp authentication-key 2 md5 testntp trusted-key 1ntp trusted-key 2ntp server 10.1.1.1 key 1ntp server 10.2.1.1 key 2 preferRelated Commands
show running-config object-group
To display the current object groups, use the show running-config object-group command in privileged EXEC mode.
show running-config [all] object-group [protocol | service | network | icmp-type | id obj_grp_id]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config object-group command:
hostname# show running-config object-groupobject-group protocol proto_grp_1protocol-object udpprotocol-object tcpobject-group service eng_service tcpport-object eq smtpport-object eq telnetobject-group icmp-type icmp-allowedicmp-object echoicmp-object time-exceededRelated Commands
show running-config passwd
To show the encrypted login passwords, use the show running-config passwd command in privileged EXEC mode.
show running-config {passwd | password}
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The password is saved to the configuration in encrypted form, so you cannot view the original password after you enter it. The password displays with the encrypted keyword to indicate that the password is encrypted.
Examples
The following is sample output from the show running-config passwd command:
hostname# show running-config passwdpasswd 2AfK9Kjr3BE2/J2r encryptedRelated Commands
show running-config pim
To display the PIM commands in the running configuration, use the show running-config pim command in privileged EXEC mode.
show running-config pim
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Usage Guidelines
The show running-config pim command displays the pim commands entered in global configuration mode. It does not show the pim commands entered in interface configuration mode. To see the pim commands entered in interface configuration mode, enter the show running-config interface command.
Examples
The following is sample output from the show running-config pim command:
hostname# show running-config pimpim old-register-checksumpim spt-threshold infinityRelated Commands
show running-config policy-map
To display all the policy-map configurations or the default policy-map configuration, use the show running-config policy-map command in privileged EXEC mode.
show running-config [all] policy-map
Syntax Description
Defaults
Omitting the all keyword displays only the explicitly configured policy-map configuration.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Usage Guidelines
Specifying the all keyword displays the default policy-map configuration as well as the explicitly configured policy-map configuration.
Examples
This example shows the use of the show running-config policy-map command for the policy map named localmap1,and the command output:
hostname# show running-config policy-map!policy-map localmap1description this is a test.class firstclasspriorityids promiscuous fail0closeset connection random-seq# enableclass class-default!Related Commands
policy-map
Configures a policy; that is, an association of a traffic class and one or more actions.
clear configure policy-map
Removes the entire policy configuration.
show running-config pop3s
To display the running configuration for POP3S, use the show running-config pop3s command in privileged EXEC mode. To have the display include the default configuration, use the all keyword.
show running-config [all] pop3s
Syntax Description
Defaults
No default behavior or values.
Command History
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Global configuration
•
—
•
—
—
Examples
The following is sample output from the show running-config pop3s command:
hostname# show running-config pop3spop3sserver 10.160.102.188authentication-server-group KerbSvrauthentication aaahostname# show running-config all pop3spop3sport 995server 10.160.102.188outstanding 20name-separator :server-separator @authentication-server-group KerbSvrno authorization-server-groupno accounting-server-groupno default-group-policyauthentication aaaRelated Commands
clear configure pop3s
Removes the POP3S configuration.
pop3s
Creates or edits a POP3S e-mail proxy configuration.
show running-config port-forward
To display the set(s) of applications that WebVPN users can access over forwarded TCP ports, use the show running-config port-forward command in privileged EXEC mode.
show running-config [all] port-forward
Syntax Description
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Examples
The following is sample output from the show running-config port-forward command:
hostname# show running-config port-forwardport-forward Telnet 3500 10.148.1.5 23port-forward Telnet 3501 10.148.1.81 23port-forward Telnet 3502 10.148.1.82 23port-forward SSH2 4976 10.148.1.81 22port-forward SSH2 4977 10.148.1.85 22port-forward Apps1 10143 flask.CompanyA.com 143port-forward Apps1 10110 flask.CompanyA.com 110port-forward Apps1 10025 flask.CompanyA.com 25port-forward Apps1 11533 sametime-im.CompanyA.com 1533port-forward Apps1 10022 ddts.CompanyA.com 22port-forward Apps1 54000 10.148.1.5 23port-forward Apps1 58000 vpn3060-1 23port-forward Apps1 58001 vpn3005-1 23hostname#Related CommandsASA-4#
show running-config prefix-list
To display the prefix-list command in the running configuration, use the show running-config prefix-list command in privileged EXEC mode.
show running-config prefix-list
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
7.0
This command was changed from the show prefix-list command to the show running-config prefix-list command.
Usage Guidelines
The prefix-list description commands always appear before their associated prefix-list commands in the running configuration. It does not matter what order you entered them.
Examples
The following is sample output from the show running-config prefix-list command:
hostname# show running-config prefix-list!prefix-list abc description A sample prefix listprefix-list abc seq 5 permit 192.168.0.0/8 le 24prefix-list abc seq 10 deny 10.0.0.0/8 le 32!Related Commands
clear configure prefix-list
Clears the prefix-list commands from the running configuration.
show running-config priority-queue
To display the priority queue configuration details for an interface, use the show running-config priority-queue command in privileged EXEC mode.
show running-config priority-queue interface-name
Syntax Description
interface-name
Specifies the name of the interface for which you want to show the priority queue details
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
This example shows the use of the show running-config priority-queue command for the interface named test, and the command output:
hostname# show running-config priority-queue testpriority-queue testqueue-limit 50tx-ring-limit 10hostname#Related Commands
show running-config privilege
To display the privileges for a command or a set of commands, use the show running-config privilege command in privileged EXEC mode.
show running-config [all] privilege [all | command command | level level]
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Usage Guidelines
Use the show running-config privilege command to view the current privilege level.
Examples
hostname(config)# show running-config privilege level 0privilege show level 0 command checksumprivilege show level 0 command curprivprivilege configure level 0 mode enable command enableprivilege show level 0 command historyprivilege configure level 0 command loginprivilege configure level 0 command logoutprivilege show level 0 command pagerprivilege clear level 0 command pagerprivilege configure level 0 command pagerprivilege configure level 0 command quitprivilege show level 0 command versionRelated Commands
show running-config rip
To display the information about the RIP configuration, use the show running-config rip command in privileged EXEC mode.
show running-config [all] rip [interface_name]
Syntax Description
all
(Optional) Shows all RIP commands, including the commands you have not changed from the default.
interface_name
(Optional) Displays only the RIP commands for the specified interface.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
Examples
This example shows how to display RIP information:
hostname# show running-config riprip outside passive version 2 authentication md5 thisisakey 2rip outside default version 2 authentication md5 thisisakey 2rip inside passive version 1rip dmz passive version 2Related Commands
clear configure rip
Clears all RIP commands from the running configuration.
debug rip
Displays debug information for RIP.
rip
Configures RIP on the specified interface.
show running-config route
To display the route configuration that is running on the security appliance, use the show running-config route command in privileged EXEC mode.
show running-config [all] route
Syntax Description
No default behavior or values.
Defaults
This command has no arguments or keywords.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config route command:
hostname# show running-config routeroute outside 10.30.10.0 255.255.255.0 1Related Commands
show running-config route-map
To display the information about the route map configuration, use the show running-config route-map command in privileged EXEC mode.
show running-config route-map [map_tag]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
•
—
Command History
Usage Guidelines
To show all route-maps defined in the configuration, use the show running-config route-map command. To show individual route-maps by name, use the show running-config route-map map_tag command, where map_tag is the name of the route-map. Multiple route maps may share the same map tag name.
Examples
The following is sample output from the show running-config route-map command:
hostname# show running-config route-maproute-map maptag1 permit sequence 10set metric 5match metric 3route-map maptag1 permit sequence 12set metric 5match interface backupmatch metric 3route-map maptag2 deny sequence 10match interface dmzRelated Commands
show running-config router
To display the global commands in the router configuration, use the show running-config router command in privileged EXEC mode.
show running-config [all] router [ospf [process_id]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Command History
7.0
This command was changed from the show router command to the show running-config router command.
Examples
The following is sample output from the show running-config router command:
hostname# show running-config router ospf 1router ospf 1log-adj-changes detailignore lsa mospfno compatible rfc1583distance ospf external 200timers spf 10 20timers lsa-group-pacing 60Related Commands
clear configure router
Clears all router commands from the running configuration.
show running-config same-security-traffic
To display the same-security interface communication, use the show running-config same-security-traffic command in privileged EXEC mode.
show running-config same-security-traffic
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config same-security-traffic command:
hostname# show running-config same-security-trafficRelated Commands
same-security-traffic
Permits communication between interfaces with equal security levels.
show running-config service
To display the system services, use the show running-config service command in privileged EXEC mode.
show running-config service
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
This command shows how to display the system services:
hostname# show running-config serviceservice resetoutside
Related Commands
show running-config service-policy
To display all currently running service policy configurations, use the show runnig-config service-policy command in global configuration mode.
show running-config service-policy
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
·
Command History
Examples
The following is an example of the show running-config service-policy command:
hostname# show running-config service-policy
Related Commands
show running-configuration smtps
To display the running configuration for smpts, use the show running-configuration smtps command in privileged EXEC mode. To have the display include the default configuration, use the all keyword.
show running-configuration [all] smtps
Syntax Description
Defaults
No default behavior or values.
Command History
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Global configuration
•
—
•
—
—
Examples
The following is sample output from the show running-config smtps command:
hostname# show running-configuration smtpssmtpsserver 10.1.1.21authentication-server-group KerbSvrauthentication aaahostname# show running-config all smtpssmtpsport 995server 10.1.1.21outstanding 20name-separator :server-separator @authentication-server-group KerbSvrno authorization-server-groupno accounting-server-groupno default-group-policyauthentication aaahostname#Related CommandsASA-4#
clear configure smtps
Removes the SMTPS configuration.
smtps
Creates or edits an SMTPS e-mail proxy configuration
show running-config snmp-map
To show the SNMP maps that have been configured, use the show running-config snmp-map command in privileged EXEC mode.
show running-config snmp-map map_name
Syntax Description
.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show running-config snmp-map command displays the SNMP maps that have been configured.Examples
The following is sample output from the show running-config snmp-map command:
hostname# show running-config snmp-map snmp-policy!snmp-map snmp-policydeny version 1!Related Commands
show running-config snmp-server
To display all currently running SNMP server configurations, use the show runnig-config snmp-server command in global configuration mode.
show running-config [default] snmp-server
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
·
·
·
·
Command History
Examples
The following is an example of the show running-config snmp-server command:
hostname# show running-config snmp-server
Related Commandshostname# show running-config servi
snmp-server
Configures the SNMP server.
clear snmp-server
Clears the SNMP server configuration.
show snmp-server statistics
Displays SNMP server configuration.
show running-config ssh
To show the SSH commands in the current configuration, use the show running-config ssh command in privileged EXEC mode.
show running-config [default] ssh [timeout | version]
show run [default] ssh [timeout]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
7.0
The command was changed from the show ssh command to the show running-config ssh command.
Usage Guidelines
This command shows the current ssh configuration. To display only the SSH session timeout value, use the timeout option. To see a list of active SSH sessions, use the show ssh sessions command.
Examples
The following example displays the SSH session timeout:
hostname# show running-config timeoutssh timeout 5 minuteshostname#Related Commands
show running-config ssl
To display the current set of configured ssl commands, use the show running-config ssl command in privileged EXEC mode.
show running-config ssl
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Global configuration
•
•
•
•
•
Command History
Examples
The following is sample output from the show running-config ssl command:
hostname# show running-config sslssl server-version tlsv1ssl client-version tlsv1-onlyssl encryption 3des-sha1ssl trust-point FirstcertRelated Commands
show running-config static
To display all static commands in the configuration, use the show running-config static command in privileged EXEC mode.
show running-config static
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
This command displays the maximum connections value for the UDP protocol. If the UDP maximum connections value is "0" or not set, the limit enforcement is disabled.
Examples
This example shows how to display all static commands in the configuration:
hostname# show running-config staticstatic (inside,outside) 192.150.49.91 10.1.1.91 netmask 255.255.255.255static (inside,outside) 192.150.49.200 10.1.1.200 netmask 255.255.255.255 tcp 255 0
Note
Related Commands
show running-config sunrpc-server
To display the information about the SunRPC configuration, use the show running-config sunrpc-server command in privileged EXEC mode.
show running-config sunrpc-server interface_name ip_addr mask service service_type protocol [TCP | UDP] port port [- port] timeout hh:mm:ss
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The service_type is specified in the sunrpcinfo command.
Examples
The following is sample output from the show running-config sunrpc-server command:
hostname# show running-config sunrpc-serverinside 30.26.0.23 255.255.0.0 service 2147483647 protocol TCP port 2222 timeout 0:03:00Related Commands
show running-config sysopt
To show the sysopt command configuration in the running configuration, use the show running-config sysopt command in privileged EXEC mode.
show running-config sysopt
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config sysopt command:
hostname# show running-config sysoptno sysopt connection timewaitsysopt connection tcpmss 1200sysopt connection tcpmss minimum 400no sysopt nodnsalias inboundno sysopt nodnsalias outboundno sysopt radius ignore-secretsysopt connection permit-ipsecRelated Commands
show running-config tcp-map
To display the information about the TCP map configuration, use the show running-config tcp-map command in privileged EXEC mode.
show running-config tcp-map [tcp_map_name]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show running-config tcp-map command:
hostname# show running-config tcp-maptcp-map localmapRelated Commands
tcp-map
Creates a TCP map and allows access to tcp-map configuration mode.
clear configure tcp-map
Clears the TCP map configuration.
show running-config telnet
To display the current list of IP addresses that are authorized to use Telnet connections to the security appliance, use the show running-config telnet command in privileged EXEC mode. You can also use this command to display the number of minutes that a Telnet session can remain idle before being closed by the security appliance.
show running-config telnet [timeout]
Syntax Description
timeout
(Optional) Displays the number of minutes that a Telnet session can be idle before being closed by the security appliance.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
This example shows how to display the current list of IP addresses that are authorized for use by Telnet connections to the security appliance:
hostname# show running-config telnet2003 Jul 15 14:49:36 %MGMT-5-LOGIN_FAIL:User failed tolog in from 128.107.183.22 through Telnet2003 Jul 15 14:50:27 %MGMT-5-LOGIN_FAIL:User failed to log in from 128.107.183.22 through TelnetRelated Commands
clear configure telnet
Removes the Telnet connection from the configuration.
telnet
Adds Telnet access to the console and sets the idle timeout.
show running-config terminal
To display the current terminal settings, use the show running-config terminal command in privileged EXEC mode.
show running-config terminal
Syntax Description
This command has no keywords or arguments.
Defaults
The default display width is 80 columns.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Examples
The following example clears the page length setting:
hostname# show running-config terminalWidth = 80, no monitorRelated Commands
clear configure terminal
Clears the terminal display width setting.
terminal
Sets the terminal line parameters.
terminal width
Sets the terminal display width.
show running-config tftp-server
To display the default TFTP server address and directory, use the show running-config tftp-server command in global configuration mode.
show running-config tftp-server
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Examples
This example shows how to display the IP/IPv6 address of the default TFTP server and the directory of the configuration file:
hostname(config)# show running-config tftp-servertftp-server inside 10.1.1.42 /temp/config/test_configRelated Commands
show running-config timeout
To display the timeout value of all protocols, or just a specific one, use the show running-config timeout command in privileged EXEC mode.
show running-config timeout protocol
Syntax Description
protocol
(Optional) Displays the timeout value of the specified protocol. Supported protocols are: xlate, conn, udp, icmp, rpc, h323, h225, mgcp, mgcp-pat, sip, sip_media, and uauth.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
This example shows how to display the timeout values for the system:
hostname(config)# show timeouttimeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 rpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00timeout uauth 0:00:00 absoluteRelated Commands
clear configure timeout
Restores the default idle time durations.
timeout
Sets the maximum idle time duration.
show running-config tunnel-group
To display tunnel group information about all or a specified tunnel group and tunnel-group attributes, use the show running-config tunnel-group command in global configuration or privileged EXEC mode.
show running-config [all] tunnel-group [name [general-attributes | ipsec-attributes | ppp-attributes]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
Privileged EXEC
•
•
Command History
Examples
The following example entered in global configuration mode, displays the current configuration for all tunnel groups:
hostname<config># show running-config tunnel-grouptunnel-group 209.165.200.225 type IPSec_L2Ltunnel-group 209.165.200.225 ipsec-attributespre-shared-key xyzxhostname<config>#Related Commands
show running-config url-block
To show the configuration for buffers and memory allocation used by URL filtering, use the show running-config url-block command in privileged EXEC mode.
show running-config url-block [ block | url-mempool | url-size ]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show running-config url-block command displays the configuration for buffers and memory allocation used by URL filtering.Examples
The following is sample output from the show running-config url-block command:
hostname# show running-config url-block!url-block block 56!Related Commands
show running-config url-cache
To show the cache configuration used by URL filtering, use the show running-config url-cache command in privileged EXEC mode.
show running-config url-cache
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show running-config url-cache command displays the cache configuration used by URL filtering.Examples
The following is sample output from the show running-config url-cache command:
hostname# show running-config url-cache!url-cache src_dst 128!Related Commands
show running-configuration url-list
To display the set(s) of URLs that WebVPN users can access, use the show running-configuration url-list command in privileged EXEC mode.
show running-configuration url-list
Syntax Description
This command has no arguments or keywords.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Global configuration
•
—
•
—
—
Webvpn
•
—
•
—
—
Command History
Examples
The following is sample output from the show running-configuration url-list command:
hostname# show running-configuration url-listurl-list userURL "SW Engineering" http://10.1.1.2url-list userURL "My Company" http://www.mycompany.comurl-list userURL "401K Program" https://401k.comurl-list userURL "Exchange5.5 Mail" http://10.1.1.11/exchangeurl-list URLlist2 "OWA-2000" http://10.1.1.7/exchangeRelated Commands
show running-config url-server
To show the URL filtering server configuration, use the show running-config url-server command in privileged EXEC mode.
show running-config url-server
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show running-config url-server command displays the URL filtering server configuration.Examples
The following is sample output from the show running-config url-server command:
hostname# show running-config url-server!url-server (perimeter) vendor websense host 10.0.1.1!Related Commands
show running-config username
To display the running configuration for a particular user, use the show running-config username command in privileged EXEC mode with the username appended. To display the running configuration for all users, use this command without a username.
show running-config [all] username [name] [attributes]]
Syntax Description
attributes
Displays the specific AVPs for the user(s)
all
(Optional) Displays all username commands, including the commands you have not changed from the default.
name
Provides the name of the user.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Global configuration
•
—
•
—
—
Username
•
—
•
—
—
Command History
Examples
The following is sample output from the show the running-config username for a user named anyuser:
hostname# show running-config username anyuserusername anyuser password .8T1d6ik58/lzXS5 encrypted privilege 3username anyuser attributesvpn-group-policy DefaultGroupPolicyvpn-idle-timeout 10vpn-session-timeout 120vpn-tunnel-protocol IPSecRelated Commands
clear config username
Clears the username database.
username
Adds a user to the security appliance database.
username attributes
Lets you configure attributes for specific users.
show running-config virtual
To display the IP address of the security appliance virtual server, use the show running-config virtual command in privileged EXEC mode.
show running-config [all] virtual
Syntax Description
Defaults
Omitting the all keyword displays the explicitly configured IP address of the current virtual server or servers.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Usage Guidelines
You must be in privileged EXEC mode to use this command.
Examples
This example displays the show running-config virtual command output for a situation in which there is a previously configured HTTP virtual server:
hostname(config)# show running-config virtualvirtual http 192.168.201.1Related Commands
clear configure virtual
Removes virtual command statements from the configuration.
virtual
Displays the address for authentication virtual servers.
show running-config vpn load-balancing
To display the current VPN load-balancing virtual cluster configuration, use the show running-config vpn-load-balancing command in global configuration, privileged EXEC, or VPN load-balancing mode.
show running-config [all] vpn load-balancing
Syntax Description
Defaults
Omitting the all keyword displays the explicitly configured VPN load-balancing configuration.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
vpn load-balancing
•
—
•
—
—
Command History
Usage Guidelines
The show running-config vpn load-balancing command also displays configuration information for the following related commands: cluster encryption, cluster ip address, cluster key, cluster port, nat, participate, and priority.
Examples
This example displays show running-config vpn load-balancing command and its output, with the all option enabled:
hostname(config)# show running-config all vpn load-balancingvpn load-balancingno natpriority 9interface lbpublic testinterface lbprivate insideno cluster ip addressno cluster encryptioncluster port 9023no participateRelated Commands
show running-configuration vpn-sessiondb
To display the current set of configured vpnsessiondb commands, use the show running-configuration vpn-sessiondb command in privileged EXEC mode.
show running-configuration [all] vpn-sessiondb
Syntax Description
all
(Optional) Displays all vpn-sessionddb commands, including the commands you have not changed from the default
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Usage Guidelines
As of Release 7.0, this command displays only the VPN maximum sessions limit, if configured.
Examples
The following is sample output for the show running-configuration vpn-sessiondb command:
hostname# show running-configuration vpn-sessiondbRelated Commands
show running-configuration webvpn
To display the running configuration for webvpn, use the show running-configuration webvpn command in privileged EXEC mode. To have the display include the default configuration, use the all keyword.
show running-configuration [all] webvpn
Syntax Description
Defaults
No default behavior or values.
Command History
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
—
•
—
—
Global configuration
•
—
•
—
—
Examples
The following is sample output from the show running-config webvpn command:
hostname# show running-configuration webvpnwebvpntitle WebVPN Services for ASA-4title-color greendefault-idle-timeout 0nbns-server 10.148.1.28 master timeout 2 retry 2accounting-server-group RadiusACS1authentication-server-group RadiusACS2authorization-dn-attributes CNhostname#(config-webvpn)# show running-config all webvpnwebvpntitle WebVPN Services for ASA-4username-prompt Usernamepassword-prompt Passwordlogin-message Please enter your username and passwordlogout-message Goodbyeno logotitle-color greensecondary-color #CCCCFFtext-color whitesecondary-text-color blackdefault-idle-timeout 0no http-proxyno https-proxynbns-server 10.148.1.28 master timeout 2 retry 2accounting-server-group RadiusACS1authentication-server-group RadiusACS2no authorization-server-groupdefault-group-policy DfltGrpPolicyauthentication aaano authorization-requiredauthorization-dn-attributes CNhostname#Related CommandsASA-4#
clear configure smtps
Removes the smtps configuration.
smtps
Creates or edits an SMTPS e-mail proxy configuration
show service-policy
To display the configured service policies, use the service-policy command in global configuration mode.
show service-policy [global | interface intf] [inspect | ips | police | priority | set connection]
show service-policy [global | interface intf] [flow protocol {host src_host | src_ip src_mask} [eq src_port] {host dest_host | dest_ip dest_mask} [eq dest_port] [icmp_number | icmp_control_message]]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
·
·
·
·
·
Command History
Usage Guidelines
The flow keyword lets you determine, for any flow that you can describe, the policies that the security appliance would apply to that flow. You can use this to check that your service policy configuration will provide the services you want for specific connections. The arguments and keywords following the flow keyword specifies the flow in ip-5-tuple format with no object grouping.
Because the flow is described in ip-5-tuple format, not all match criteria are supported. Following are the list of match criteria that are supported for flow match:
•
•
•
•
The priority keyword is used to display the aggregate counter values of packets transmitted through an interface.
The number of embryonic connections displayed in the show service-policy command output indicates the current number of embryonic connections to an interface for traffic matching that defined by the class-map command. The embryonic-conn-max field shows the maximum embryonic limit configured for the traffic class using the Modular Policy Framework. If the current embryonic connections displayed equals or exceeds the maximum, TCP intercept is applied to new TCP connections that match the traffic type defined by the class-map command.
protocol Argument Values
The following are valid values for the protocol argument:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
icmp_control_message Argument Values
The following are valid values for the icmp_control_message argument:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following example shows the syntax of the show service-policy command:
hostname# show service-policy globalGlobal policy:Service-policy: inbound_policyClass-map: ftp-portInspect: ftp strict inbound_ftp, packet 0, drop 0, reset-drop 0hostname# show service-policy priorityInterface outside:Global policy:Service-policy: sa_global_fw_policyInterface outside:Service-policy: ramapClass-map: clientmapPriority:Interface outside: aggregate drop 0, aggregate transmit 5207048Class-map: udpmapPriority:Interface outside: aggregate drop 0, aggregate transmit 5207048Class-map: cmaphostname# show service-policy flow udp host 209.165.200.229 host 209.165.202.158 eq 5060Global policy:Service-policy: f1_global_fw_policyClass-map: inspection_defaultMatch: default-inspection-trafficAction:Input flow: inspect sipInterface outside:Service-policy: testClass-map: testMatch: access-list testAccess rule: permit ip 209.165.200.229 255.255.255.224 209.165.202.158 255.255.255.224Action:Input flow: ids inlineInput flow: set connection conn-max 10 embryonic-conn-max 20Related Commands
show service-policy inspect gtp
To display the GTP configuration, use the show service-policy inspect gtp command in privileged EXEC mode.
show service-policy [interface int] inspect gtp {pdp-context [apn ap_name | detail | imsi IMSI_value | ms-addr IP_address | tid tunnel_ID | version version_num ] | pdpmcb | requests | statistics [gsn IP_address] }
Syntax Description
.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
You can use the vertical bar | to filter the display. Type | for more display filtering options.
The show pdp-context command displays PDP context-related information.
The Packet Data Protocol context is identified by the tunnel ID, which is a combination of IMSI and NSAPI. A GTP tunnel is defined by two associated PDP Contexts in different GSN nodes and is identified with a Tunnel ID. A GTP tunnel is necessary to forward packets between an external packet data network and a mobile station user.
The show gtp requests command displays current requests in the request queue.Examples
The following is sample output from the show gtp requests command:
hostname# show gtp requests0 in use, 0 most used, 200 maximum allowedYou can use the vertical bar | to filter the display, as in the following example:
hostname# show service-policy gtp statistics | grep gsnThis example shows the GTP statistics with the word gsn in the output.
The following command shows the statistics for GTP inspection:
hostname# show service-policy inspect gtp statisticsGPRS GTP Statistics:version_not_support | 0 | msg_too_short | 0unknown_msg | 0 | unexpected_sig_msg | 0unexpected_data_msg | 0 | ie_duplicated | 0mandatory_ie_missing | 0 | mandatory_ie_incorrect | 0optional_ie_incorrect | 0 | ie_unknown | 0ie_out_of_order | 0 | ie_unexpected | 0total_forwarded | 0 | total_dropped | 0signalling_msg_dropped | 0 | data_msg_dropped | 0signalling_msg_forwarded | 0 | data_msg_forwarded | 0total created_pdp | 0 | total deleted_pdp | 0total created_pdpmcb | 0 | total deleted_pdpmcb | 0pdp_non_existent | 0The following command displays information about the PDP contexts:
hostname# show service-policy inspect gtp pdp-context1 in use, 1 most used, timeout 0:00:00Version TID | MS Addr | SGSN Addr | Idle | APNv1 | 1234567890123425 | 1.1.1.1 | 11.0.0.2 0:00:13 gprs.cisco.com| user_name (IMSI): 214365870921435 | MS address: | 1.1.1.1| primary pdp: Y | nsapi: 2| sgsn_addr_signal: | 11.0.0.2 | sgsn_addr_data: | 11.0.0.2| ggsn_addr_signal: | 9.9.9.9 | ggsn_addr_data: | 9.9.9.9| sgsn control teid: | 0x000001d1 | sgsn data teid: | 0x000001d3| ggsn control teid: | 0x6306ffa0 | ggsn data teid: | 0x6305f9fc| seq_tpdu_up: | 0 | seq_tpdu_down: | 0| signal_sequence: | 0| upstream_signal_flow: | 0 | upstream_data_flow: | 0| downstream_signal_flow: | 0 | downstream_data_flow: | 0| RAupdate_flow: | 0Table 7-29 describes each column the output from the show service-policy inspect gtp pdp-context command.
Related Commands
show shun
To display shun information, use the show shun command in privileged EXEC mode.
show shun [src_ip | statistics]
Syntax Description
src_ip
(Optional) Displays the information for that address.
statistics
(Optional) Displays the interface counters only.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Examples
The following is sample output from the show shun command:
hostname# show shunshun (outside) 10.1.1.27 10.2.2.89 555 666 6shun (inside1) 10.1.1.27 10.2.2.89 555 666 6Related Commands
show sip
To display SIP sessions, use the show sip command in privileged EXEC mode.
show sip
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show sip command assists in troubleshooting SIP inspection engine issues and is described with the inspect protocol sip udp 5060 command. The show timeout sip command displays the timeout value of the designated protocol.
The show sip command displays information for SIP sessions established across the security appliance. Along with the debug sip and show local-host commands, this command is used for troubleshooting SIP inspection engine issues.
Note
Examples
The following is sample output from the show sip command:
hostname# show sipTotal: 2call-id c3943000-960ca-2e43-228f@10.130.56.44| state Call init, idle 0:00:01call-id c3943000-860ca-7e1f-11f7@10.130.56.45| state Active, idle 0:00:06This sample shows two active SIP sessions on the security appliance (as shown in the Total field). Each call-id represents a call.
The first session, with the call-id c3943000-960ca-2e43-228f@10.130.56.44, is in the state Call Init, which means the session is still in call setup. Call setup is complete only when the ACK is seen. This session has been idle for 1 second.
The second session is in the state Active, in which call setup is complete and the endpoints are exchanging media. This session has been idle for 6 seconds.
Related Commands
show skinny
To troubleshoot SCCP (Skinny) inspection engine issues, use the show skinny command in privileged EXEC mode.
show skinny
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show skinny command assists in troubleshooting SCCP (Skinny) inspection engine issues.
Examples
The following is sample output from the show skinny command under the following conditions. There are two active Skinny sessions set up across the security appliance. The first one is established between an internal Cisco IP Phone at local address 10.0.0.11 and an external Cisco CallManager at 172.18.1.33. TCP port 2000 is the CallManager. The second one is established between another internal Cisco IP Phone at local address 10.0.0.22 and the same Cisco CallManager.
hostname# show skinnyLOCAL FOREIGN STATE---------------------------------------------------------------1 10.0.0.11/52238 172.18.1.33/2000 1MEDIA 10.0.0.11/22948 172.18.1.22/207982 10.0.0.22/52232 172.18.1.33/2000 1MEDIA 10.0.0.22/20798 172.18.1.11/22948The output indicates a call has been established between both internal Cisco IP Phones. The RTP listening ports of the first and second phones are UDP 22948 and 20798 respectively.
The following is the xlate information for these Skinny connections:
hostname# show xlate debug2 in use, 2 most usedFlags: D | DNS, d | dump, I | identity, i | inside, n | no random,| o | outside, r | portmap, s | staticNAT from inside:10.0.0.11 to outside:172.18.1.11 flags si idle 0:00:16 timeout 0:05:00NAT from inside:10.0.0.22 to outside:172.18.1.22 flags si idle 0:00:14 timeout 0:05:00Related Commands
show snmp-server statistics
To display information about the SNMP server statistics, use the show snmp-server statistics command in privileged EXEC mode.
show snmp-server statistics
Syntax Description
This command has no arguments or keywords.
Defaults
This command has no default settings.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
Command History
Examples
This example shows how to display the SNMP server statistics:
hostname# show snmp-server statistics0 SNMP packets input0 Bad SNMP version errors0 Unknown community name0 Illegal operation for community name supplied0 Encoding errors0 Number of requested variables0 Number of altered variables0 Get-request PDUs0 Get-next PDUs0 Get-bulk PDUs0 Set-request PDUs (Not supported)0 SNMP packets output0 Too big errors (Maximum packet size 512)0 No such name errors0 Bad values errors0 General errors0 Response PDUs0 Trap PDUsRelated Commands
show ssh sessions
To display information about the active SSH session on the security appliance, use the show ssh sessions command in privileged EXEC mode.
show ssh sessions [ip_address]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The SID is a unique number that identifies the SSH session. The Client IP is the IP address of the system running an SSH client. The Version is the protocol version number that the SSH client supports. If the SSH only supports SSH version 1, then the Version column displays 1.5. If the SSH client supports both SSH version 1 and SSH version 2, then the Version column displays 1.99. If the SSH client only supports SSH version 2, then the Version column displays 2.0. The Encryption column shows the type of encryption that the SSH client is using. The State column shows the progress that the client is making as it interacts with the security appliance. The Username column lists the login username that has been authenticated for the session.
Examples
The following example demonstrates the output of the show ssh sessions command:
hostname# show ssh sessionsSID Client IP Version Mode Encryption Hmac State Username0 172.69.39.39 1.99 IN aes128-cbc md5 SessionStarted patOUT aes128-cbc md5 SessionStarted pat1 172.23.56.236 1.5 - 3DES - SessionStarted pat2 172.69.39.29 1.99 IN 3des-cbc sha1 SessionStarted patOUT 3des-cbc sha1 SessionStarted patRelated Commands
ssh disconnect
Disconnects an active SSH session.
ssh timeout
Sets the timeout value for idle SSH sessions.
show startup-config
To show the startup configuration, use the show startup-config command in privileged EXEC mode.
show startup-config
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
In multiple context mode, this command shows the startup configuration for your current execution space: the system configuration or the security context.
Examples
The following is sample output from the show startup-config command:
hostname# show startup-config: Saved: Written by enable_15 at 01:44:55.598 UTC Thu Apr 17 2003Version 7.0(0)28!interface GigabitEthernet0/0nameif insidesecurity-level 100ip address 10.86.194.60 255.255.254.0webvpn enable!interface GigabitEthernet0/1shutdownnameif testsecurity-level 0ip address 10.10.4.200 255.255.0.0!...!enable password 8Ry2YjIyt7RRXU24 encryptedpasswd 2KFQnbNIdI.2KYOU encryptedhostname firewall1domain-name example.comboot system disk0:/cdisk.binftp mode passivenamesname 10.10.4.200 outsideaccess-list xyz extended permit ip host 192.168.0.4 host 150.150.0.3!ftp-map ftp_map!ftp-map inbound_ftpdeny-request-cmd appe stor stou!...Cryptochecksum:4edf97923899e712ed0da8c338e07e63Related Commands
show sunrpc-server active
To display the pinholes open for Sun RPC services, use the show sunrpc-server active command in privileged EXEC mode.
show sunrpc-server active
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
Use the show sunrpc-server active command to display the pinholes open for Sun RPC services, such as NFS and NIS.
Examples
To display the pinholes open for Sun RPC services, enter the show sunrpc-server active command. The following is sample output from the show sunrpc-server active command:
hostname# show sunrpc-server activeLOCAL FOREIGN SERVICE TIMEOUT-----------------------------------------------192.168.100.2/0 209.165.200.5/32780 100005 00:10:00Related Commands
show tcpstat
To display the status of the security appliance TCP stack and the TCP connections that are terminated on the security appliance (for debugging), use the show tcpstat command in privileged EXEC mode. This command supports IPv4 and IPv6 addresses.
show tcpstat
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The show tcpstat command allows you to display the status of the TCP stack and TCP connections that are terminated on the security appliance. The TCP statistics displayed are described in Table 7-30.
Examples
This example shows how to display the status of the TCP stack on the security appliance:
hostname# show tcpstatCURRENT MAX TOTALtcb_cnt 2 12 320proxy_cnt 0 0 160tcp_xmt pkts = 540591tcp_rcv good pkts = 6583tcp_rcv drop pkts = 2tcp bad chksum = 0tcp user hash add = 2028tcp user hash add dup = 0tcp user srch hash hit = 316753tcp user srch hash miss = 6663tcp user hash delete = 2027tcp user hash delete miss = 0lip = 172.23.59.230 fip = 10.21.96.254 lp = 443 fp = 2567 st = 4 rexqlen = 0in0tw_timer = 0 to_timer = 179000 cl_timer = 0 per_timer = 0rt_timer = 0tries 0Related Commands
show tech-support
To display the information that is used for diagnosis by technical support analysts, use the show tech-support command in privileged EXEC mode.
show tech-support [detail | file | no-config]
Syntax Description
detail
(Optional) Lists detailed information.
file
(Optional) Writes the output of the command to a file.
no-config
(Optional) Excludes the output of the running configuration.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
—
•
Command History
Usage Guidelines
The show tech-support command lets you list information that technical support analysts need to help you diagnose problems. This command combines the output from the show commands that provide the most information to a technical support analyst.
Examples
The following example shows how to display information that is used for technical support analysis, excluding the output of the running configuration:
hostname# show tech-support no-configCisco XXX Firewall Version X.X(X)Cisco Device Manager Version X.X(X)Compiled on Fri 15-Apr-05 14:35 by rootXXX up 2 days 8 hoursHardware: XXX, 64 MB RAM, CPU Pentium 200 MHzFlash i28F640J5 @ 0x300, 16MBBIOS Flash AT29C257 @ 0xfffd8000, 32KB0: ethernet0: address is 0003.e300.73fd, irq 101: ethernet1: address is 0003.e300.73fe, irq 72: ethernet2: address is 00d0.b7c8.139e, irq 9Licensed Features:Failover: DisabledVPN-DES: EnabledVPN-3DES-AES: DisabledMaximum Interfaces: 3Cut-through Proxy: EnabledGuards: EnabledURL-filtering: EnabledInside Hosts: UnlimitedThroughput: UnlimitedIKE peers: UnlimitedThis XXX has a Restricted (R) license.Serial Number: 480430455 (0x1ca2c977)Running Activation Key: 0xc2e94182 0xc21d8206 0x15353200 0x633f6734Configuration last modified by enable_15 at 23:05:24.264 UTC Sat Nov 16 2002------------------ show clock ------------------00:08:14.911 UTC Sun Apr 17 2005------------------ show memory ------------------Free memory: 50708168 bytesUsed memory: 16400696 bytes------------- ----------------Total memory: 67108864 bytes------------------ show conn count ------------------0 in use, 0 most used------------------ show xlate count ------------------0 in use, 0 most used------------------ show blocks ------------------SIZE MAX LOW CNT4 1600 1600 160080 400 400 400256 500 499 5001550 1188 795 919------------------ show interface ------------------interface ethernet0 "outside" is up, line protocol is upHardware is i82559 ethernet, address is 0003.e300.73fdIP address 172.23.59.232, subnet mask 255.255.0.0MTU 1500 bytes, BW 10000 Kbit half duplex1267 packets input, 185042 bytes, 0 no bufferReceived 1248 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort20 packets output, 1352 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 9 deferred0 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (13/128) software (0/2)output queue (curr/max blocks): hardware (0/1) software (0/1)interface ethernet1 "inside" is up, line protocol is downHardware is i82559 ethernet, address is 0003.e300.73feIP address 10.1.1.1, subnet mask 255.255.255.0MTU 1500 bytes, BW 10000 Kbit half duplex0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort1 packets output, 60 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred1 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (128/128) software (0/0)output queue (curr/max blocks): hardware (0/1) software (0/1)interface ethernet2 "intf2" is administratively down, line protocol is downHardware is i82559 ethernet, address is 00d0.b7c8.139eIP address 127.0.0.1, subnet mask 255.255.255.255MTU 1500 bytes, BW 10000 Kbit half duplex0 packets input, 0 bytes, 0 no bufferReceived 0 broadcasts, 0 runts, 0 giants0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort0 packets output, 0 bytes, 0 underruns0 output errors, 0 collisions, 0 interface resets0 babbles, 0 late collisions, 0 deferred0 lost carrier, 0 no carrierinput queue (curr/max blocks): hardware (128/128) software (0/0)output queue (curr/max blocks): hardware (0/0) software (0/0)------------------ show cpu usage ------------------CPU utilization for 5 seconds = 0%; 1 minute: 0%; 5 minutes: 0%------------------ show process ------------------PC SP STATE Runtime SBASE Stack ProcessHsi 001e3329 00763e7c 0053e5c8 0 00762ef4 3784/4096 arp_timerLsi 001e80e9 00807074 0053e5c8 0 008060fc 3832/4096 FragDBGCLwe 00117e3a 009dc2e4 00541d18 0 009db46c 3704/4096 dbgtraceLwe 003cee95 009de464 00537718 0 009dc51c 8008/8192 LoggerHwe 003d2d18 009e155c 005379c8 0 009df5e4 8008/8192 tcp_fastHwe 003d2c91 009e360c 005379c8 0 009e1694 8008/8192 tcp_slowLsi 002ec97d 00b1a464 0053e5c8 0 00b194dc 3928/4096 xlate cleanLsi 002ec88b 00b1b504 0053e5c8 0 00b1a58c 3888/4096 uxlate cleanMwe 002e3a17 00c8f8d4 0053e5c8 0 00c8d93c 7908/8192 tcp_intercept_timesLsi 00423dd5 00d3a22c 0053e5c8 0 00d392a4 3900/4096 route_processHsi 002d59fc 00d3b2bc 0053e5c8 0 00d3a354 3780/4096 XXX Garbage CollecrHwe 0020e301 00d5957c 0053e5c8 0 00d55614 16048/16384 isakmp_time_keeprLsi 002d377c 00d7292c 0053e5c8 0 00d719a4 3928/4096 perfmonHwe 0020bd07 00d9c12c 0050bb90 0 00d9b1c4 3944/4096 IPSecMwe 00205e25 00d9e1ec 0053e5c8 0 00d9c274 7860/8192 IPsec timer handlerHwe 003864e3 00db26bc 00557920 0 00db0764 6952/8192 qos_metric_daemonMwe 00255a65 00dc9244 0053e5c8 0 00dc8adc 1436/2048 IP BackgroundLwe 002e450e 00e7bb94 00552c30 0 00e7ad1c 3704/4096 XXX/traceLwe 002e471e 00e7cc44 00553368 0 00e7bdcc 3704/4096 XXX/tconsoleHwe 001e5368 00e7ed44 00730674 0 00e7ce9c 7228/8192 XXX/intf0Hwe 001e5368 00e80e14 007305d4 0 00e7ef6c 7228/8192 XXX/intf1Hwe 001e5368 00e82ee4 00730534 2470 00e8103c 4892/8192 XXX/intf2H* 0011d7f7 0009ff2c 0053e5b0 780 00e8511c 13004/16384 ci/consoleCsi 002dd8ab 00e8a124 0053e5c8 0 00e891cc 3396/4096 update_cpu_usageHwe 002cb4d1 00f2bfbc 0051e360 0 00f2a134 7692/8192 uauth_inHwe 003d17d1 00f2e0bc 00828cf0 0 00f2c1e4 7896/8192 uauth_threadHwe 003e71d4 00f2f20c 00537d20 0 00f2e294 3960/4096 udp_timerHsi 001db3ca 00f30fc4 0053e5c8 0 00f3004c 3784/4096 557mcfixCrd 001db37f 00f32084 0053ea40 121094970 00f310fc 3744/4096 557pollLsi 001db435 00f33124 0053e5c8 0 00f321ac 3700/4096 557timerHwe 001e5398 00f441dc 008121e0 0 00f43294 3912/4096 fover_ip0Cwe 001dcdad 00f4523c 00872b48 20 00f44344 3528/4096 ip/0:0Hwe 001e5398 00f4633c 008121bc 0 00f453f4 3532/4096 icmp0Hwe 001e5398 00f47404 00812198 0 00f464cc 3896/4096 udp_thread/0Hwe 001e5398 00f4849c 00812174 0 00f475a4 3832/4096 tcp_thread/0Hwe 001e5398 00f495bc 00812150 0 00f48674 3912/4096 fover_ip1Cwe 001dcdad 00f4a61c 008ea850 0 00f49724 3832/4096 ip/1:1Hwe 001e5398 00f4b71c 0081212c 0 00f4a7d4 3912/4096 icmp1Hwe 001e5398 00f4c7e4 00812108 0 00f4b8ac 3896/4096 udp_thread/1Hwe 001e5398 00f4d87c 008120e4 0 00f4c984 3832/4096 tcp_thread/1Hwe 001e5398 00f4e99c 008120c0 0 00f4da54 3912/4096 fover_ip2Cwe 001e542d 00f4fa6c 00730534 0 00f4eb04 3944/4096 ip/2:2Hwe 001e5398 00f50afc 0081209c 0 00f4fbb4 3912/4096 icmp2Hwe 001e5398 00f51bc4 00812078 0 00f50c8c 3896/4096 udp_thread/2Hwe 001e5398 00f52c5c 00812054 0 00f51d64 3832/4096 tcp_thread/2Hwe 003d1a65 00f78284 008140f8 0 00f77fdc 300/1024 listen/http1Mwe 0035cafa 00f7a63c 0053e5c8 0 00f786c4 7640/8192 Crypto CA------------------ show failover ------------------No license for Failover------------------ show traffic ------------------outside:received (in 205213.390 secs):1267 packets 185042 bytes0 pkts/sec 0 bytes/sectransmitted (in 205213.390 secs):20 packets 1352 bytes0 pkts/sec 0 bytes/secinside:received (in 205215.800 secs):0 packets 0 bytes0 pkts/sec 0 bytes/sectransmitted (in 205215.800 secs):1 packets 60 bytes0 pkts/sec 0 bytes/secintf2:received (in 205215.810 secs):0 packets 0 bytes0 pkts/sec 0 bytes/sectransmitted (in 205215.810 secs):0 packets 0 bytes0 pkts/sec 0 bytes/sec------------------ show perfmon ------------------PERFMON STATS: Current AverageXlates 0/s 0/sConnections 0/s 0/sTCP Conns 0/s 0/sUDP Conns 0/s 0/sURL Access 0/s 0/sURL Server Req 0/s 0/sTCP Fixup 0/s 0/sTCPIntercept 0/s 0/sHTTP Fixup 0/s 0/sFTP Fixup 0/s 0/sAAA Authen 0/s 0/sAAA Author 0/s 0/sAAA Account 0/s 0/sRelated Commands
show traffic
To display interface transmit and receive activity, use the show traffic command in privileged EXEC mode.
show traffic
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show traffic command lists the number of packets and bytes moving through through each interface since the last show traffic command was entered or since the security appliance came online. The number of seconds is the duration the security appliance has been online since the last reboot, unless the clear traffic command was entered since the last reboot. If this is the case, then the number of seconds is the duration since that command was entered.
Examples
The following example shows output from the show traffic command:
hostname# show trafficoutside: received (in 102.080 secs): 2048 packets 204295 bytes 20 pkts/sec 2001 bytes/sec transmitted (in 102.080 secs): 2048 packets 204056 bytes 20 pkts/sec 1998 bytes/sec Ethernet0: received (in 102.080 secs): 2049 packets 233027 bytes 20 pkts/sec 2282 bytes/sec transmitted (in 102.080 secs): 2048 packets 232750 bytes 20 pkts/sec 2280 bytes/secRelated Commands
show uauth
To display one or all currently authenticated users, the host IP to which they are bound, and any cached IP and port authorization information, use the show uauth command in privileged EXEC mode.
show uauth [username]
Syntax Description
username
(Optional) Specifies, by username, the user authentication and authorization information to display.
Defaults
Omitting username displays the authorization information for all users.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Usage Guidelines
The show uauth command displays the AAA authorization and authentication caches for one user or for all users.
This command is used with the timeout command.
Each user host IP address has an authorization cache attached to it. The cache allows up to 16 address and service pairs for each user host. If the user attempts to access a service that has been cached from the correct host, the security appliance considers it preauthorized and immediately proxies the connection. Once you are authorized to access a website, for example, the authorization server is not contacted for each image as it is loaded (assuming the images come from the same IP address). This process significantly increases performance and reduces the load on the authorization server.
The output from the show uauth command displays the username that is provided to the authorization server for authentication and authorization purposes, the IP address to which the username is bound, and whether the user is authenticated only or has cached services.
Note
Use the timeout uauth command to specify how long the cache should be kept after the user connections become idle. Use the clear uauth command to delete all the authorization caches for all the users, which will cause them to have to reauthenticate the next time that they create a connection.
Examples
This example shows sample output from the show uauth command when no users are authenticated and one user authentication is in progress:
hostname(config)# show uauthCurrent Most SeenAuthenticated Users 0 0Authen In Progress 0 1This example shows sample output from the show uauth command when three users are authenticated and authorized to use services through the security appliance:
hostname(config)# show uauthuser `pat' from 209.165.201.2 authenticateduser `robin' from 209.165.201.4 authorized to:port 192.168.67.34/telnet 192.168.67.11/http 192.168.67.33/tcp/8001192.168.67.56/tcp/25 192.168.67.42/ftpuser `terry' from 209.165.201.7 authorized to:port 192.168.1.50/http 209.165.201.8/httpRelated Commands
clear uauth
Remove current user authentication and authorization information.
timeout
Set the maximum idle time duration.
show url-block
To display the number of packets held in the url-block buffer and the number (if any) dropped due to exceeding the buffer limit or retransmission, use the show url-block command in privileged EXEC mode.
show url-block [block statistics]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show url-block block statistics command displays the number of packets held in the url block buffer and the number (if any) dropped due to exceeding the buffer limit or retransmission.
Examples
The following is sample output from the show url-block command:
hostname# show url-block| url-block url-mempool 128 | url-block url-size 4 | url-block block 128This shows the configuration of the URL block buffer.
The following is sample output from the show url-block block statistics command:
hostname# show url-block block statisticsURL Pending Packet Buffer Stats with max block 128 |Cumulative number of packets held: | 896Maximum number of packets held (per URL): | 3Current number of packets held (global): | 38Packets dropped due to| exceeding url-block buffer limit: | 7546| HTTP server retransmission: | 10Number of packets released back to client: | 0Related Commands
show url-cache statistics
To display information about the url-cache, which is used for URL responses received from an N2H2 or Websense filtering server, use the show url-cache statistics command in privileged EXEC mode.
show url-cache statistics
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show url-cache statistics command displays the following entries:
•
•
•
•
•
You can view additional information about N2H2 Sentian or Websense filtering activity with the show perfmon command.
Examples
The following is sample output from the show url-cache statistics command:
hostname# show url-cache statisticsURL Filter Cache Stats----------------------| Size : 1KBEntries : 36In Use : 30Lookups : 300| Hits : 290Related Commands
show url-server
To display information about the URL filtering server, use the show url-server command in privileged EXEC mode.
show url-server statistics
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show url-server statistics command displays the URL server vendor; number of URLs total, allowed, and denied; number of HTTPS connections total, allowed, and denied; number of TCP connections total, allowed, and denied; and the URL server status.
The show url-server command displays the following information:
•
•
Examples
The following is sample output from the show url-server statistics command:
hostname## show url-server statisticsURL Server Statistics: |Vendor websenseHTTPs total/allowed/denied 0/0/0HTTPSs total/allowed/denied 0/0/0FTPs total/allowed/denied 0/0/0 |URL Server Status: |172.23.58.103 UP |URL Packets Send and Receive Stats: |Message Send ReceiveSTATUS_REQUEST 200 200LOOKUP_REQUEST 10 10LOG_REQUEST 20 NARelated Commands
show version
To display the software version, hardware configuration, license key, and related uptime data, use the show version command in user EXEC mode.
show version
Syntax Description
This command has no arguments or keywords.
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
User EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show version command allows you to display the software version, operating time since the last reboot, processor type, Flash partition type, interface boards, serial number (BIOS ID), activation key value, license type (R or UR), and time stamp for when the configuration was last modified.
The serial number listed with the show version command is for the Flash partition BIOS. This number is different from the serial number on the chassis. When you get a software upgrade, you will need the serial number that appears in the show version command, not the chassis number.
Note
Examples
The following example shows how to display the software version, hardware configuration, license key, and related uptime information:
hostname# show versionCisco PIX Security Appliance Software Version 7.0(4)Device Manager Version 5.0(4)Compiled on Tue 27-Sep-05 10:41 by rootSystem image file is "flash:/cdisk.bin"Config file at boot was "startup-config"pix2 up 7 days 7 hoursHardware: PIX-515E, 128 MB RAM, CPU Pentium II 433 MHzFlash E28F128J3 @ 0xfff00000, 16MBBIOS Flash AM29F400B @ 0xfffd8000, 32KB0: Ext: Ethernet0 : address is 0011.2094.1d2b, irq 101: Ext: Ethernet1 : address is 0011.2094.1d2c, irq 11Licensed features for this platform:Maximum Physical Interfaces : 6Maximum VLANs : 25Inside Hosts : UnlimitedFailover : Active/ActiveVPN-DES : EnabledVPN-3DES-AES : EnabledCut-through Proxy : EnabledGuards : EnabledURL Filtering : EnabledSecurity Contexts : 5GTP/GPRS : EnabledVPN Peers : UnlimitedThis platform has an Unrestricted (UR) license.Serial Number: 808184143Running Activation Key: 0xcf22f25d 0xec1c3174 0x8cb138a0 0xaad8b878 0x4f32fd90Configuration last modified by enable_15 at 14:18:26.103 UTC Thu Oct 6 2005hostname#Related Commands
show hardware
Displays detail hardware information.
show serial
Displays the hardware serial information.
show uptime
Displays how long the security appliance has been up.
show vpn load-balancing
To display the runtime statistics for the VPN load-balancing virtual cluster configuration, use the show vpn-load-balancing command in global configuration, privileged EXEC, or VPN load-balancing mode.
show vpn load-balancing
Syntax Description
This command has no variables or arguments.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Privileged EXEC
•
—
•
—
—
vpn load-balancing
•
—
•
—
—
Command History
Usage Guidelines
The show vpn load-balancing command displays statistical information for the virtual VPN load-balancing cluster. If the local device is not participating in the VPN load-balancing cluster, this command indicates that VPN load balancing has not been configured for this device.
Examples
This example displays show vpn load-balancing command and its output for a situation in which the local device is participating in the VPN load-balancing cluster:
hostname(config-load-balancing)# show vpn load-balancingStatus: enabled Role: Master Failover: n/a Encryption: enabled Cluster IP: 192.168.1.100 Peers: 1Public IP Role Pri Model Load (%) Sessions -------------------------------------------------------------- * 192.168.1.40 Master 10 PIX-515 0 0 192.168.1.110 Backup 5 PIX-515 0 0 hostname(config-load-balancing)#If the local device is not participating in the VPN load-balancing cluster, the show vpn load-balancing command shows a different result:
hostname(config)# show vpn load-balancingVPN Load Balancing has not been configured.Related Commands
show vpn-sessiondb
To display information about VPN sessions, use the show vpn-sessiondb command in privileged EXEC mode. The command includes options for displaying information in full or in detail, lets you specify type of sessions to display, and provides options to filter and sort the information. The syntax table and usage notes organize the choices accordingly.
show vpn-sessiondb [detail] [full] {remote | l2l | index indexnumber | webvpn | svc | email-proxy} [filter {name username | ipaddress IPaddr | a-ipaddress IPaddr | p-ipaddress IPaddr | tunnel-group groupname | protocol protocol-name | encryption encryption-algo}]
[sort {name | ipaddress | a-ipaddress | p-ip address | tunnel-group | protocol | encryption}]Syntax Description
s
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Usage Guidelines
You can use the following options to filter and to sort the session display:
The following example, entered in privileged EXEC mode, shows detailed information about LAN-to-LAN sessions:
hostname# show vpn-sessiondb detail l2lSession Type: LAN-to-LAN DetailedConnection : 172.16.0.1Index : 1 IP Addr : 172.16.0.1Protocol : IPSecLAN2LAN Encryption : AES256Bytes Tx : 48484156 Bytes Rx : 875049248Login Time : 09:32:03 est Mon Aug 2 2004Duration : 6:16:26Filter Name :IKE Sessions: 1 IPSec Sessions: 2IKE:Session ID : 1UDP Src Port : 500 UDP Dst Port : 500IKE Neg Mode : Main Auth Mode : preSharedKeysEncryption : AES256 Hashing : SHA1Rekey Int (T): 86400 Seconds Rekey Left(T): 63814 SecondsD/H Group : 5IPSec:Session ID : 2Local Addr : 10.0.0.0/255.255.255.0Remote Addr : 209.165.201.30/255.255.255.0Encryption : AES256 Hashing : SHA1Encapsulation: Tunnel PFS Group : 5Rekey Int (T): 28800 Seconds Rekey Left(T): 10903 SecondsBytes Tx : 46865224 Bytes Rx : 2639672Pkts Tx : 1635314 Pkts Rx : 37526IPSec:Session ID : 3Local Addr : 10.0.0.1/255.255.255.0Remote Addr : 209.165.201.30/255.255.255.0Encryption : AES256 Hashing : SHA1Encapsulation: Tunnel PFS Group : 5Rekey Int (T): 28800 Seconds Rekey Left(T): 6282 SecondsBytes Tx : 1619268 Bytes Rx : 872409912Pkts Tx : 19277 Pkts Rx : 1596809hostname#Related Commands
show vpn-sessiondb ratio
To display the ratio of current sessions as a percentage by protocol or encryption algorithm, use the show vpn-sessiondb ratio command in privileged EXEC mode.
show vpn-sessiondb ratio {protocol | encryption} [filter groupname]
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Examples
The following is sample output for the show vpn-sessiondb ratio command, with encryption as the argument:
hostname# show vpn-sessiondb ratio encFilter Group : AllTotal Active Sessions: 5Cumulative Sessions : 9Encryption Sessions Percentnone 0 0%DES 1 20%3DES 0 0%AES128 4 80%AES192 0 0%AES256 0 0%The following is sample output for the show vpn-sessiondb ratio command with protocol as the argument:
hostname# show vpn-sessiondb ratio protocolFilter Group : AllTotal Active Sessions: 6Cumulative Sessions : 10Protocol Sessions PercentIKE 0 0%IPSec 1 20%IPSecLAN2LAN 0 0%IPSecLAN2LANOverNatT 0 0%IPSecOverNatT 0 0%IPSecOverTCP 1 20%IPSecOverUDP 0 0%vpnLoadBalanceMgmt 0 0%userHTTPS 0 0%IMAP4S 3 30%POP3S 0 0%SMTPS 3 30%Related Commandsshow vpn-sessiondb ratio
show vpn-sessiondb summary
To display the a summary of current VPN sessions, use the show vpn-sessiondb summary command in privileged EXEC mode. The session summary includes total current sessions, current sessions of each type, peak and total cumulative sessions, and maximum concurrent sessions.
show vpn-sessiondb summary
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
—
—
•
Command History
Examples
The following is sample output for the show vpn-sessiondb summary command:
hostname# show vpn-sessiondb summaryActive Sessions: Session Information:
LAN-to-LAN : 2 Peak Concurrent : 7
Remote Access : 5 Concurrent Limit: 2000
WebVPN : 0 Cumulative Sessions: 12
Email Proxy : 0
Related Commands Total Active Sessions : 7
show xlate
To display information about the translation slots, use the show xlate command in privileged EXEC mode.
show xlate [global ip1[-ip2] [netmask mask]] [local ip1[-ip2] [netmask mask]]
[gport port1[-port2]] [lport port1[-port2]] [interface if_name] [state state] [debug] [detail]show xlate count
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
•
Command History
Usage Guidelines
The show xlate command displays the contents of the translation slots. The show xlate detail command displays the following information:
•
•
The translation flags are defined in Table 7-31.
Note
Examples
The following is sample output from the show xlate command. It shows how translation slot information with three active PATs.
hostname# show xlate3 in use, 3 most usedPAT Global 192.150.49.1(0) Local 10.1.1.15 ICMP id 340PAT Global 192.150.49.1(1024) Local 10.1.1.15(1028)PAT Global 192.150.49.1(1024) Local 10.1.1.15(516)The following is sample output from the show xlate detail command.It shows the translation type and interface information with three active PATs.
The first entry is a TCP PAT for host port (10.1.1.15, 1025) on the inside network to host-port (192.150.49.1, 1024) on the outside network. The r flag indicates that the translation is a PAT. The i flag indicates that the translation applies to the inside address port.
The second entry is a UDP PAT for host port (10.1.1.15, 1028) on the inside network to host port (192.150.49.1, 1024) on the outside network. The r flag indicates that the translation is a PAT. The i flag indicates that the translation applies to the inside address port.
The third entry is an ICMP PAT for host-ICMP-id (10.1.1.15, 21505) on the inside network to host-ICMP-id (192.150.49.1, 0) on the outside network. The r flag indicates that the translation is a PAT. The i flag indicates that the translation applies to the inside address ICMP ID.
The inside address fields appear as source addresses on packets traversing from the more secure interface to the less secure interface. They appear as destination addresses on packets traversing from the less secure interface to the more secure interface.
hostname# show xlate detail3 in use, 3 most usedFlags: D - DNS, d - dump, I - identity, i - inside, n - no random,r - portmap, s - staticTCP PAT from inside:10.1.1.15/1026 to outside:192.150.49.1/1024 flags riUDP PAT from inside:10.1.1.15/1028 to outside:192.150.49.1/1024 flags riICMP PAT from inside:10.1.1.15/21505 to outside:192.150.49.1/0 flags riThe following is sample output from the show xlate command. It shows two static translations. The first translation has one associated connection (called "nconns"), and the second translation has four associated connections.
hostname# show xlateGlobal 209.165.201.10 Local 209.165.201.10 static nconns 1 econns 0Global 209.165.201.30 Local 209.165.201.30 static nconns 4 econns 0Related Commands
shun
To block connections from an attacking host, use the shun command in privileged EXEC mode. To disable a shun, use the no form of this command.
shun source_ip [dest_ip source_port dest_port [protocol]] [vlan vlan_id]
no shun source_ip [vlan vlan_id]
Syntax Description
Defaults
The default protocol is 0 (any protocol).
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
The shun command lets you block connections from an attacking host. All future connections from the source IP address are dropped and logged until the blocking function is removed manually or by the Cisco IPS sensor. The blocking function of the shun command is applied whether or not a connection with the specified host address is currently active.
If you specify the destination address, source and destination ports, and the protocol, then you drop the matching connection as well as placing a shun on all future connections from the source IP address; all future connections are shunned, not just those that match these specific connection parameters.
You can only have one shun command per source IP address.
Because the shun command is used to block attacks dynamically, it is not displayed in the security appliance configuration.
Whenever an interface configuration is removed, all shuns that are attached to that interface are also removed. If you add a new interface or replace the same interface (using the same name), then you must add that interface to the IPS sensor if you want the IPS sensor to monitor that interface.
Examples
The following example shows that the offending host (10.1.1.27) makes a connection with the victim (10.2.2.89) with TCP. The connection in the security appliance connection table reads as follows:
10.1.1.27, 555-> 10.2.2.89, 666 PROT TCPApply the shun command using the following options:
hostname# shun 10.1.1.27 10.2.2.89 555 666 tcpThe command deletes the specific current connection from the security appliance connection table and also prevents all future packets from 10.1.1.27 from going through the security appliance.
Related Commands
clear shun
Disables all the shuns that are currently enabled and clears the shun statistics.
show conn
Shows all active connections.
show shun
Displays the shun information.
shutdown
To disable an interface, use the shutdown command in interface configuration mode. To enable an interface, use the no form of this command.
shutdown
no shutdown
Syntax Description
This command has no arguments or keywords.
Defaults
All physical interfaces are shut down by default. Allocated interfaces in security contexts are not shut down in the configuration.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
•
•
•
•
Command History
7.0
This command was moved from a keyword of the interface command to an interface configuration mode command.
Usage Guidelines
By default, all physical interfaces are shut down. You must enable the physical interface before any traffic can pass through an enabled subinterface. For multiple context mode, if you allocate a physical interface or subinterface to a context, the interfaces are enabled by default in the context. However, before traffic can pass through the context interface, you must also enable the interface in the system configuration. If you shut down an interface in the system execution space, then that interface is down in all contexts that share it.
Note
Examples\
The following example enables a main interface:
hostname(config)# interface gigabitethernet0/2hostname(config-if)# speed 1000hostname(config-if)# duplex fullhostname(config-if)# nameif insidehostname(config-if)# security-level 100hostname(config-if)# ip address 10.1.1.1 255.255.255.0hostname(config-if)# no shutdownThe following example enables a subinterface:
hostname(config)# interface gigabitethernet0/2.1hostname(config-subif)# vlan 101hostname(config-subif)# nameif dmz1hostname(config-subif)# security-level 50hostname(config-subif)# ip address 10.1.2.1 255.255.255.0hostname(config-subif)# no shutdownThe following example shuts down the subinterface:
hostname(config)# interface gigabitethernet0/2.1hostname(config-subif)# vlan 101hostname(config-subif)# nameif dmz1hostname(config-subif)# security-level 50hostname(config-subif)# ip address 10.1.2.1 255.255.255.0hostname(config-subif)# shutdownRelated Commands
clear xlate
Resets all translations for existing connections, causing the connections to be reset.
interface
Configures an interface and enters interface configuration mode.
smtps
To enter SMTPS configuration mode, use the smtps command in global configuration mode. To remove any commands entered in SMTPS command mode, use the no version of this command. SMTPS is a TCP/IP protocol that lets you to send e-mail over an SSL connection.
smtps
no smtps
Syntax Description
This command has no arguments or keywords.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Examples
The following example shows how to enter SMTPS configuration mode:
hostname(config)# smtpshostname(config-smtps)#Related Commands
clear configure smtps
Removes the SMTPS configuration.
show running-config smtps
Displays the running configuration for SMTPS.
smtp-server
To configure an SMTP server, use the smtp-server command in global configuration mode. To remove the attribute from the configuration, use the no version of this command.
The security appliance includes an internal SMTP client that the Events system can use to notify external entities that a certain event has occurred. You can configure SMTP servers to receive these event notices, and then forward them to specified e-mail addresses. The SMTP facility is active only when you enable E-mail events an the security appliance.
smtp-server {primary_server} [backup_server]
no smtp-server
Syntax Description
Defaults
No SMTP server is configured by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
—
—
•
Command History
Usage Guidelines
Examples
The following example shows how to set an SMTP server with an IP address of 10.1.1.24, and a backup SMTP server with an IP address of 10.1.1.34:
hostname(config)# smtp-server 10.1.1.24 10.1.1.34Related Commands
snmp-server
To provide the security appliance event information through SNMP, use the snmp-server command in privileged EXEC mode. To disable the SNMP commands, use the no form of this command.
snmp-server {community | contact | location} text}
no snmp-server {community | contact | location} text}
snmp-server host interface_name ip_addr [community commstr] [trap | poll] [version vers] [udp-port udp_port]
no snmp-server host interface_name ip_addr [community commstr] [trap | poll] [version vers] [udp-port udp_port]
snmp-server enable [traps [all | feature [trap1 ... [trapn]]]
no snmp-server enable [traps [all | feature [trap1 ... [trapn]]]
snmp-server listen-port lport
no snmp-server listen-port lport
Syntax Description
community text
Specifies the security appliance community string to the SNMP management station.
contact text
Specifies the name of the contact person or the PIX system administrator.
location text
Specifies the security appliance location.
host
Specifies an IP address of the SNMP management station to which traps should be sent and/or from which the SNMP requests come.
interface_name
Interface name where the SNMP management station resides.
ip_addr
IP address of a host to which SNMP traps should be sent and/or from which the SNMP requests come.
trap
(Optional) Specifies that only traps are sent and that this host is not allowed to poll.
poll
(Optional) Specifies that this host is allowed to poll.
enable
Enable specific SNMP trap notifications.
enable traps
Enables sending log messages as SNMP trap notifications.
all
Enable or disable traps for all features.
community
Specifies the community string of the security appliance.
commstr
The community string for a specific host.
feature
The feature for which traps are enabled.
trapn
A specific trap to enable.
listen-port
Override the default port (161) for incoming SNMP requests.1
lport
The port on which incoming requests will be accepted.
udp-port udp_port
Configure port to which notifications will be sent
1 The listen-port keyword is only available in admin context because the snmp-server command is not available in the system context.
Defaults
By default, both traps and polls are acted upon.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
·
·
·
·
Command History
Usage Guidelines
The snmp-server command allows you to identify the site, management station, community string, and user information.
Enter the password key in use at the SNMP management station. The SNMP community string is a shared secret among the SNMP management station and the network nodes being managed. The security appliance uses the key to determine if the incoming SNMP request is valid. For example, you could designate a site with a community string and then configure the routers, security appliance, and the management station with this same string. The security appliance uses this string and does not respond to requests with an invalid community string.
The contact text is case sensitive and can be up to 127 characters. Spaces are accepted, but multiple spaces are shortened to a single space.
The location text is case sensitive and can be up to 127 characters. Spaces are accepted, but multiple spaces are shortened to a single space.
You can specify up to 32 SNMP management stations.
When configuring a host using the snmp-server host command, specifying the trap option will cause the device to reject incoming requests from the host.
The clear configure snmp-server and no snmp-server commands disable the SNMP commands in the configuration as follows:
hostname(config)# no snmp-server locationhostname(config)# no snmp-server contacthostname(config)# snmp-server community publichostname(config)# no snmp-server enable trapsExamples
This example shows the commands that you would enter to start receiving SNMP requests from a management station:
hostname(config)# snmp-server community wallawallabingbanghostname(config)# snmp-server location Building 42, Sector 54hostname(config)# snmp-server contact Sherlock Holmeshostname(config)# snmp-server host perimeter 10.1.2.42Related Commands
snmp-map
To identify a specific map for defining the parameters for SNMP inspection, use the snmp-map command in global configuration mode. To remove the map, use the no form of this command.
snmp-map map_name
no snmp-map map_name
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Use the snmp-map command to identify a specific map to use for defining the parameters for SNMP inspection. When you enter this command, the system enters the SNMP map configuration mode, which lets you enter the different commands used for defining the specific map. After defining the SNMP map, you use the inspect snmp command to enable the map. Then you use the class-map, policy-map, and service-policy commands to define a class of traffic, to apply the inspect command to the class, and to apply the policy to one or more interfaces.
Examples
The following example shows how to identify SNMP traffic, define a SNMP map, define a policy, and apply the policy to the outside interface.
hostname(config)# access-list snmp-acl permit tcp any any eq 161hostname(config)# access-list snmp-acl permit tcp any any eq 162hostname(config)# class-map snmp-porthostname(config-cmap)# match access-list snmp-aclhostname(config-cmap)# exithostname(config)# snmp-map inbound_snmphostname(config-snmp-map)# deny version 1hostname(config-snmp-map)# exithostname(config)# policy-map inbound_policyhostname(config-pmap)# class snmp-porthostname(config-pmap-c)# inspect snmp inbound_snmphostname(config-pmap-c)# exitRelated Commands
snmp-server enable trap remote-access
To enable threshold trapping, use the snmp-server enable trap remote-access command in global configuration mode. To disable threshold trapping, use the no version of this command. This command lets the security appliance send traps when remote access sessions reach the number set with the remote-access threshold session-threshold-exceeded command.
snmp-server enable trap remote-access session-threshold-exceeded
no snmp-server enable trap remote-access
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
—
—
Command History
Examples
The following example shows how to enable threshold trapping:
hostname# snmp-server enable trap remote-access session-threshold-exceededRelated Commands
remote-access threshold session-threshold-exceeded
Specifies a number of active, concurrent, remote access sessions, at which point the security appliance sends traps.
speed
To set the speed of a copper (RJ-45) Ethernet interface, use the speed command in interface configuration mode. To restore the speed setting to the default, use the no form of this command.
speed {auto | 10 | 100 | 1000 | nonegotiate}
no speed [auto | 10 | 100 | 1000 | nonegotiate]
Syntax Description
Defaults
For copper interfaces, the default is speed auto.
For fiber interfaces, the default is no speed nonegotiate.
Command Modes
The following table shows the modes in which you can enter the command:
Interface configuration
•
•
•
—
•
Command History
7.0
This command was moved from a keyword of the interface command to an interface configuration mode command.
Usage Guidelines
Set the speed on the physical interface only.
If your network does not support auto detection, set the speed to a specific value.
For RJ-45 interfaces on the ASA 5500 series adaptive security appliance, the default auto-negotiation setting also includes the Auto-MDI/MDIX feature. Auto-MDI/MDIX eliminates the need for crossover cabling by performing an internal crossover when a straight cable is detected during the auto-negotiation phase. Either the speed or duplex must be set to auto-negotiate to enable Auto-MDI/MDIX for the interface. If you explicitly set both the speed and duplex to a fixed value, thus disabling auto-negotiation for both settings, then Auto-MDI/MDIX is also disabled.
Examples
The following example sets the speed to 1000BASE-T:
hostname(config)# interface gigabitethernet0/1hostname(config-if)# speed 1000hostname(config-if)# duplex fullhostname(config-if)# nameif insidehostname(config-if)# security-level 100hostname(config-if)# ip address 10.1.1.1 255.255.255.0hostname(config-if)# no shutdownRelated Commands
split-dns
To enter a list of domains to be resolved through the split tunnel, use the split-dns command in group-policy configuration mode. To delete a list, use the no form of this command.
To delete all split tunneling domain lists, use the no split-dns command without arguments. This deletes all configured split tunneling domain lists, including a null list created by issuing the split-dns none command.
When there are no split tunneling domain lists, users inherit any that exist in the default group policy. To prevent users from inheriting such split tunneling domain lists, use the split-dns none command.
split-dns {value domain-name1 domain-name2 domain-nameN | none}
no split-dns [domain-name domain-name2 domain-nameN]
Syntax Description
Defaults
Split DNS is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Group policy
•
—
•
—
—
Command History
Usage Guidelines
Use a single space to separate each entry in the list of domains. There is no limit on the number of entries, but the entire string can be no longer than 255 characters. You can use only alphanumeric characters, hyphens (-), and periods (.).
The no split-dns command, when used without arguments, deletes all current values, including a null value created by issuing the split-dns none command.
Note
Examples
The following example shows how to configure the domains Domain1, Domain2, Domain3 and Domain4 to be resolved through split tunneling for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# split-dns value Domain1 Domain2 Domain3 Domain4Related Commands
split-tunnel-network-list
To create a network list for split tunneling, use the split-tunnel-network-list command in group-policy configuration mode. To delete a network list, use the no form of this command.
To delete all split tunneling network lists, use the no split-tunnel-network-list command without arguments. This deletes all configured network lists, including a null list created by issuing the split-tunnel-network-list none command.
When there are no split tunneling network lists, users inherit any network lists that exist in the default or specified group policy. To prevent users from inheriting such network lists, use the split-tunnel-network-list none command.
Split tunneling network lists distinguish networks that require traffic to travel across the tunnel from those that do not require tunneling.
split-tunnel-network-list {value access-list name | none}
no split-tunnel-network-list value [access-list name]
Syntax Description
Defaults
By default, there are no split tunneling network lists.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
—
•
—
—
Command History
Usage Guidelines
The security appliance makes split tunneling decisions on the basis of a network list, which is a standard ACL that consists of a list of addresses on the private network.
The no split-tunnel-network-list command, when used without arguments, deletes all current network lists, including a null value created by issuing the split-tunnel-network-list none command.
Examples
The following example shows how to set a network list called FirstList for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# split-tunnel-network-list FirstListRelated Commands
split-tunnel-policy
To set a split tunneling policy, use the split-tunnel-policy command in group-policy configuration mode. To remove the split-tunnel-policy attribute from the running configuration, use the no form of this command. This enables inheritance of a value for split tunneling from another group policy.
Split tunneling lets a remote-access IPSec client conditionally direct packets over an IPSec tunnel in encrypted form, or to a network interface in cleartext form. With split-tunneling enabled, packets not bound for destinations on the other side of the IPSec tunnel do not have to be encrypted, sent across the tunnel, decrypted, and then routed to a final destination.
This command applies this split tunneling policy to a specific network.
split-tunnel-policy {tunnelall | tunnelspecified | excludespecified}
no split-tunnel-policy
Syntax Description
Defaults
Split tunneling is disabled by default, which is tunnelall.
Command Modes
The following table shows the modes in which you can enter the command:
Group-policy
•
—
•
—
—
Command History
Usage Guidelines
Split tunneling is primarily a traffic management feature, not a security feature. In fact, for optimum security, we recommend that you not enable split tunneling.
Examples
The following example shows how to set a split tunneling policy of tunneling only specified networks for the group policy named FirstGroup:
hostname(config)# group-policy FirstGroup attributeshostname(config-group-policy)# split-tunnel-policy tunnelspecifiedRelated Commands
ssh
To add SSH access to the security appliance, use the ssh command in global configuration mode. To disable SSH access to the security appliance, use the no form of this command. This command supports IPv4 and IPv6 addresses.
ssh {ip_address mask | ipv6_address/prefix} interface
no ssh {ip_address mask | ipv6_address/prefix} interface
Syntax Description
Defaults
No default behaviors or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The ssh ip_address command specifies hosts or networks that are authorized to initiate an SSH connection to the security appliance. You can have multiple ssh commands in the configuration. The no form of the command removes a specific SSH command from the configuration. Use the clear configure ssh command to remove all SSH commands.
Before you can begin using SSH to the security appliance, you must generate a default RSA key using the crypto key generate rsa command.
The following security algorithms and ciphers are supported on the security appliance:
•
•
•
•
The following SSH Version 2 features are not supported on the security appliance:
•
•
•
•
•
Examples
The following example shows how to configure the inside interface to accept SSH version 2 connections from a management console with the IP address 10.1.1.1. The idle session timeout is set to 60 minutes and SCP is enabled.
hostname(config)# ssh 10.1.1.1 255.255.255.0 insidehostname(config)# ssh version 2hostname(config)# ssh copy enablehostname(config)# ssh timeout 60Related Commands
ssh disconnect
To disconnect an active SSH session, use the ssh disconnect command in privileged EXEC mode.
ssh disconnect session_id
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Privileged EXEC
•
•
•
•
—
Command History
Usage Guidelines
You must specify a session ID. Use the show ssh sessions command to obtain the ID of the SSH session you want to disconnect.
Examples
The following example shows an SSH session being disconnected:
hostname# show ssh sessionsSID Client IP Version Mode Encryption Hmac State Username0 172.69.39.39 1.99 IN aes128-cbc md5 SessionStarted patOUT aes128-cbc md5 SessionStarted pat1 172.23.56.236 1.5 - 3DES - SessionStarted pat2 172.69.39.29 1.99 IN 3des-cbc sha1 SessionStarted patOUT 3des-cbc sha1 SessionStarted pathostname# ssh disconnect 2hostname# show ssh sessionsSID Client IP Version Mode Encryption Hmac State Username0 172.69.39.29 1.99 IN aes128-cbc md5 SessionStarted patOUT aes128-cbc md5 SessionStarted pat1 172.23.56.236 1.5 - 3DES - SessionStarted patRelated Commands
show ssh sessions
Displays information about active SSH sessions to the security appliance.
ssh timeout
Sets the timeout value for idle SSH sessions.
ssh scopy enable
To enable Secure Copy (SCP) on the security appliance, use the ssh scopy enable command in global configuration mode. To disable SCP, use the no form of this command.
ssh scopy enable
no ssh scopy enable
Syntax Description
This command has no keywords or arguments.
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
•
Command History
Usage Guidelines
SCP is a server-only implementation; it will be able to accept and terminate connections for SCP but can not initiate them. The security appliance has the following restrictions:
•
•
•
•
Examples
The following example shows how to configure the inside interface to accept SSH Version 2 connections from a management console with the IP address 10.1.1.1. The idle session timeout is set to 60 minutes and SCP is enabled.
hostname(config)# ssh 10.1.1.1 255.255.255.0 insidehostname(config)# ssh version 2hostname(config)# ssh copy enablehostname(config)# ssh timeout 60Related Commands
ssh timeout
To change the default SSH session idle timeout value, use the ssh timeout command in global configuration mode. To restore the default timeout value, use the no form of this command.
ssh timeout number
no ssh timeout
Syntax Description
number
Specifies the duration in minutes that an SSH session can remain inactive before being disconnected. Valid values are from 1 to 60 minutes.
Defaults
The default session timeout value is 5 minutes.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The ssh timeout command specifies the duration in minutes that a session can be idle before being disconnected. The default duration is 5 minutes.
Examples
The following example shows how to configure the inside interface to accept only SSH version 2 connections from a management console with the IP address 10.1.1.1. The idle session timeout is set to 60 minutes and SCP is enabled.
hostname(config)# ssh 10.1.1.1 255.255.255.0 insidehostname(config)# ssh version 2hostname(config)# ssh copy enablehostname(config)# ssh timeout 60Related Commands
ssh version
To restrict the version of SSH accepted by the security appliance, use the ssh version command in global configuration mode. To restore the default value, use the no form of this command. The default values permits SSH Version 1 and SSH Version 2 connections to the security appliance.
ssh version {1 | 2}
no ssh version [1 | 2]
Syntax Description
1
Specifies that only SSH Version 1 connections are supported.
2
Specifies that only SSH Version 2 connections are supported.
Defaults
By default, both SSH Version 1 and SSH Version 2 are supported.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
1 and 2 specify which version of SSH the security appliance is restricted to using. The no form of the command returns the security appliance to the default stance, which is compatible mode (both version can be used).
Examples
The following example shows how to configure the inside interface to accept SSH Version 2 connections from a management console with the IP address 10.1.1.1. The idle session timeout is set to 60 minutes and SCP is enabled.
hostname(config)# ssh 10.1.1.1 255.255.255.0 insidehostname(config)# ssh version 2hostname(config)# ssh copy enablehostname(config)# ssh timeout 60Related Commands
ssl client-version
To specify the SSL/TLS protocol version the security appliance uses when acting as a client, use the ssl client-version command in global configuration mode. To revert to the default, any, use the no version of this command. This command lets you restrict the versions of SSL/TLS that the security appliance sends.
ssl client-version [any | sslv3-only | tlsv1-only]
no ssl client-version
Syntax Description
Defaults
The default value is any.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
TCP Port Forwarding does not work when a WebVPN user connects with some SSL versions, as follows:
Negotiate SSLv3
Java downloads
Negotiate SSLv3/TLSv1
Java downloads
Negotiate TLSv1
Java does NOT download
TLSv1Only
Java does NOT download
SSLv3Only
Java does NOT download
The issue is that JAVA only negotiates SSLv3 in the client Hello packet when you launch the Port Forwarding application.Examples
The following example shows how to configure the security appliance to communicate using only TLSv1 when acting as an SSL client:
hostname(config)# ssl client-version tlsv1-onlyRelated Commands
ssl encryption
To specify the encryption algorithms that the SSL/TLS protocol uses, use the ssl encryption command in global configuration mode. Issuing the command again overwrites the previous setting. The ordering of the algorithms determines preference for their use. You can add or remove algorithms to meet the needs of your environment. To restore the default, which is the complete set of encryption algorithms, use the no version of the command.
ssl encryption [3des-sha1] [des-sha1] [rc4-md5] [possibly others]
no ssl encryption
Syntax Description
Defaults
The default is to have all algorithms available in the following order:
[3des-sha1] [des-sha1] [rc4-md5] [possibly others]
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Examples
The following example shows how to configure the security appliance to use the 3des-sha1 and des-sha1 encryption algorithms:
hostname(config)# ssl encryption 3des-sha1 des-sha1Related Commands
ssl server-version
To specify the SSL/TLS protocol version the security appliance uses when acting as a server, use the ssl server-version command in global configuration mode. To revert to the default, any, use the no version of this command. This command lets you restrict the versions of SSL/TSL that the security appliance accepts.
ssl server-version [any | sslv3 | tlsv1 | sslv3-only | tlsv1-only]
no ssl server-version
Syntax Description
Defaults
The default value is any.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
TCP Port Forwarding does not work when a WebVPN user connects with some SSL versions, as follows:
Negotiate SSLv3
Java downloads
Negotiate SSLv3/TLSv1
Java downloads
Negotiate TLSv1
Java does NOT download
TLSv1Only
Java does NOT download
SSLv3Only
Java does NOT download
If you configure e-mail proxy, do not set thhe SSL version to TLSv1 Only. Outlook and Outlook Express do not support TLS.
Examples
The following example shows how to configure the security appliance to communicate using only TLSv1 when acting as an SSL server:
hostname(config)# ssl server-version tlsv1-onlyRelated Commands
ssl trust-point
To specify the certificate trustpoint that represents the SSL certificate for an interface, use the ssl trust-point command with the interface argument in global configuration mode. If you do not specify an interface, this command creates the fallback trustpoint for all interfaces that do not have a trustpoint configured. To remove an SSL trustpoint from the configuration that does not specify an interface, use the no version of this command. To remove an entry that does specify an interface, use the no ssl trust-point {trustpoint [interface]} version of the command.
ssl trust-point {trustpoint [interface]}
no ssl trust-point
Syntax Description
Defaults
The default is no trustpoint association. The security appliance uses the default self-generated RSA key-pair certificate.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
•
Command History
Usage Guidelines
Observe these guidelines when using this command:
•
•
•
•
•
The following example explains how to use the no versions of this command:
The configuration includes these SSL trustpoints:
ssl trust-point tp1
ssl trust-point tp2 outside
Issue the command:
no ssl trust-point
Then show run ssl will have:
ssl trust-point tp2 outside
Examples
The following example shows how to configure an ssl trustpoint called FirstTrust for the inside interface, and a trustpoint called DefaultTrust with no associated interface.
hostname(config)# ssl trust-point FirstTrust insidehostname(config)# ssl trust-point DefaultTrustThe next example shows how to use the no version of the command to delete a trustpoint that has no associated interface:
hostname(config)# show running-configuration sslssl trust-point FirstTrust insidessl trust-point DefaultTrusthostname(config)# no ssl trust-pointhostname(config)# show running-configuration sslssl trust-point FirstTrust insideThe next example shows how to delete a trustpoint that does have an associated interface:
hostname(config)# show running-configuration sslssl trust-point FirstTrust insidessl trust-point DefaultTrusthostname(config)# no ssl trust-point FirstTrust insidehostname(config)# show running-configuration sslssl trust-point DefaultTrust
static
To configure a persistent one-to-one address translation rule by mapping a real IP address to a mapped IP address, use the static command in global configuration mode. To restore the default settings, use the no form of this command.
For static NAT:
static (real_ifc,mapped_ifc) {mapped_ip | interface} {real_ip [netmask mask] | access-list access_list_name} [dns] [norandomseq [nailed]] [[tcp] {max_conns {emb_lim}} [udp udp_max_conns]]
no static (real_ifc,mapped_ifc) {mapped_ip | interface} {real_ip [netmask mask] | access-list access_list_name} [dns] [norandomseq [nailed]] [[tcp] {max_conns {emb_lim}} [udp udp_max_conns]]
For static PAT:
static (real_ifc,mapped_ifc) {tcp | udp} {mapped_ip | interface} mapped_port {real_ip real_port [netmask mask]} | {access-list access_list_name} [dns] [norandomseq [nailed]] [[tcp] {max_conns {emb_lim}} [udp udp_max_conns]]
no static (real_ifc,mapped_ifc) {tcp | udp} {mapped_ip | interface} mapped_port {real_ip real_port [netmask mask]} | {access-list access_list_name} [dns] [norandomseq [nailed]] [[tcp] {max_conns {emb_lim}} [udp udp_max_conns]]
Syntax Description
Defaults
The defaults are as follows:
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Static NAT creates a fixed translation of real address(es) to mapped address(es).With dynamic NAT and PAT, each host uses a different address or port for each subsequent translation. Because the mapped address is the same for each consecutive connection with static NAT, and a persistent translation rule exists, static NAT allows hosts on the destination network to initiate traffic to a translated host (if there is an access list that allows it).
Note
The main difference between dynamic NAT and a range of addresses for static NAT is that static NAT allows a remote host to initiate a connection to a translated host (if there is an access list that allows it), while dynamic NAT does not. You also need an equal number of mapped addresses as real addresses with static NAT.
Static PAT is the same as static NAT, except it lets you specify the protocol (TCP or UDP) and port for the real and mapped addresses.
This feature lets you identify the same mapped address across many different static statements, so long as the port is different for each statement (you cannot use the same mapped address for multiple static NAT statements).
You cannot use the same real or mapped address in multiple static commands between the same two interfaces. Do not use a mapped address in the static command that is also defined in a global command for the same mapped interface.
When you specify the ports in policy NAT for applications that require application inspection for secondary channels (FTP, VoIP, etc.), the security appliance automatically translates the secondary ports.
NAT, in the conventional sense, is not available in transparent firewall mode. In transparent firewall mode, you can use the static command to configure maximum connections, maximum embryonic connections, and TCP sequence randomization. In this case, both the real and mapped IP addresses are the same.
You can alternatively configure maximum connections, maximum embryonic connections, and TCP sequence randomization using the set connection commands. If you configure these settings for the same traffic using both methods, then the security appliance uses the lower limit. For TCP sequence randomization, if it is disabled using either method, then the security appliance disables TCP sequence randomization.
If you specify a network for translation (for example, 10.1.1.0 255.255.255.0), then the security appliance translates the .0 and .255 addresses. If you want to prevent access to these addresses, be sure to configure an access list to deny access.
After changing or removing a static command statement, use the clear xlate command to clear the translations.
Examples
Static NAT Examples
For example, the following policy static NAT example shows a single real address that is translated to two mapped addresses depending on the destination address:
hostname(config)# access-list NET1 permit ip host 10.1.2.27 209.165.201.0 255.255.255.224hostname(config)# access-list NET2 permit ip host 10.1.2.27 209.165.200.224 255.255.255.224hostname(config)# static (inside,outside) 209.165.202.129 access-list NET1hostname(config)# static (inside,outside) 209.165.202.130 access-list NET2The following command maps an inside IP address (10.1.1.3) to an outside IP address (209.165.201.12):
hostname(config)# static (inside,outside) 209.165.201.12 10.1.1.3 netmask 255.255.255.255The following command maps the outside address (209.165.201.15) to an inside address (10.1.1.6):
hostname(config)# static (outside,inside) 10.1.1.6 209.165.201.15 netmask 255.255.255.255The following command statically maps an entire subnet:
hostname(config)# static (inside,dmz) 10.1.1.0 10.1.2.0 netmask 255.255.255.0This example shows how to permit a finite number of users to call in through H.323 using Intel Internet Phone, CU-SeeMe, CU-SeeMe Pro, MeetingPoint, or Microsoft NetMeeting. The static command maps addresses 209.165.201.0 through 209.165.201.30 to local addresses 10.1.1.0 through 10.1.1.30 (209.165.201.1 maps to 10.1.1.1, 209.165.201.10 maps to 10.1.1.10, and so on).
hostname(config)# static (inside, outside) 209.165.201.0 10.1.1.0 netmask 255.255.255.224hostname(config)# access-list acl_out permit tcp any 209.165.201.0 255.255.255.224 eq h323hostname(config)# access-group acl_out in interface outsideThis example shows the commands that are used to disable Mail Guard:
hostname(config)# static (dmz1,outside) 209.165.201.1 10.1.1.1 netmask 255.255.255.255hostname(config)# access-list acl_out permit tcp any host 209.165.201.1 eq smtphostname(config)# access-group acl_out in interface outsidehostname(config)# no fixup protocol smtp 25In the example, the static command allows you to set up a global address to permit outside hosts access to the 10.1.1.1 mail server host on the dmz1 interface. You shoud set the MX record for DNS to point to the 209.165.201.1 address so that mail is sent to this address. The access-list command allows the outside users to access the global address through the SMTP port (25). The no fixup protocol command disables Mail Guard.
Static PAT Examples
For example, for Telnet traffic initiated from hosts on the 10.1.3.0 network to the security appliance outside interface (10.1.2.14), you can redirect the traffic to the inside host at 10.1.1.15 by entering the following commands:
hostname(config)# access-list TELNET permit tcp host 10.1.1.15 eq telnet 10.1.3.0 255.255.255.0 eq telnethostname(config)# static (inside,outside) tcp 10.1.2.14 telnet access-list TELNETFor HTTP traffic initiated from hosts on the 10.1.3.0 network to the security appliance outside interface (10.1.2.14), you can redirect the traffic to the inside host at 10.1.1.15 by entering:
hostname(config)# access-list HTTP permit tcp host 10.1.1.15 eq http 10.1.3.0 255.255.255.0 eq httphostname(config)# static (inside,outside) tcp 10.1.2.14 http access-list HTTPTo redirect Telnet traffic from the security appliance outside interface (10.1.2.14) to the inside host at 10.1.1.15, enter the following command:
hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask 255.255.255.255If you want to allow the preceding real Telnet server to initiate connections, though, then you need to provide additional translation. For example, to translate all other types of traffic, enter the following commands. The original static command provides translation for Telnet to the server, while the nat and global commands provide PAT for outbound connections from the server.
hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask 255.255.255.255hostname(config)# nat (inside) 1 10.1.1.15 255.255.255.255hostname(config)# global (outside) 1 10.1.2.14If you also have a separate translation for all inside traffic, and the inside hosts use a different mapped address from the Telnet server, you can still configure traffic initiated from the Telnet server to use the same mapped address as the static statement that allows Telnet traffic to the server. You need to create a more exclusive nat statement just for the Telnet server. Because nat statements are read for the best match, more exclusive nat statements are matched before general statements. The following example shows the Telnet static statement, the more exclusive nat statement for initiated traffic from the Telnet server, and the statement for other inside hosts, which uses a different mapped address.
hostname(config)# static (inside,outside) tcp 10.1.2.14 telnet 10.1.1.15 telnet netmask 255.255.255.255hostname(config)# nat (inside) 1 10.1.1.15 255.255.255.255hostname(config)# global (outside) 1 10.1.2.14hostname(config)# nat (inside) 2 10.1.1.0 255.255.255.0hostname(config)# global (outside) 2 10.1.2.78To translate a well-known port (80) to another port (8080), enter the following command:
hostname(config)# static (inside,outside) tcp 10.1.2.45 80 10.1.1.16 8080 netmask 255.255.255.255Related Commands
strict-http
To allow forwarding of non-compliant HTTP traffic, use the strict-http command in HTTP map configuration mode, which is accessible using the http-map command. To reset this feature to its default behavior, use the no form of the command.
strict-http action {allow | reset | drop} [log]
no strict-http action {allow | reset | drop} [log]
Syntax Description
Defaults
This command is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
HTTP map configuration
•
•
•
•
—
Command History
Usage Guidelines
Although strict HTTP inspection cannot be disabled, the strict-http action allow command causes the security appliance to allow forwarding of non-compliant HTTP traffic. This command overrides the default behavior, which is to deny forwarding of non-compliant HTTP traffic.
Examples
The following example allows forwarding of non-compliant HTTP traffic:
hostname(config)# http-map inbound_httphostname(config-http-map)# strict-http allowhostname(config-http-map)# exitRelated Commands
strip-group
This command applies only to usernames received in the form user@realm. A realm is an administrative domain appended to a username with the @ delimiter (juser@abc).
To enable or disable strip-group processing, use the strip-group command in tunnel-group general-attributes mode. The security appliance selects the tunnel group for PPP connections by obtaining the group name from the username presented by the VPN client. When strip-group processing is enabled, the security appliance sends only the user part of the username for authorization/authentication. Otherwise (if disabled), the security appliance sends the entire username including the realm.
To disable strip-group processing, use the no form of this command.
strip-group
no strip-group
Syntax Description
This command has no arguments or keywords.
Defaults
The default setting for this command is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group general attributes configuration
•
—
•
—
—
Command History
Usage Guidelines
You can apply this attribute only to the IPSec remote access tunnel-type.
Examples
The following example configures a remote access tunnel group named "remotegrp" for type IPSec remote access, then enters general configuration mode, sets the tunnel group named "remotegrp" as the default group policy, and then enables strip group for that tunnel group:
hostname(config)# tunnel-group remotegrp type IPSec_rahostname(config)# tunnel-group remotegrp generalhostname(config-general)# default-group-policy remotegrphostname(config-general)# strip-grouphostname(config-general)Related Commands
strip-realm
To enable or disable strip-realm processing, use the strip-realm command in tunnel-group general-attributes configuration mode. Strip-realm processing removes the realm from the username when sending the username to the authentication or authorization server. A realm is an administrative domain appended to a username with the @ delimiter (username@realm). If the command is enabled, the security appliance sends only the user part of the username authorization/authentication. Otherwise, the security appliance sends the entire username.
To disable strip-realm processing, use the no form of this command.
strip-realm
no strip-realm
Syntax Description
This command has no arguments or keywords.
Defaults
The default setting for this command is disabled.
Command Modes
The following table shows the modes in which you can enter the command:
Tunnel-group general attributes configuration
•
—
•
—
—
Command History
Usage Guidelines
You can apply this attribute only to the IPSec remote access tunnel-type.
Examples
The following example configures a remote access tunnel group named "remotegrp" for type IPSec remote access, then enters general configuration mode, sets the tunnel group named "remotegrp" as the default group policy, and then enables strip realm for that tunnel group:
hostname(config)# tunnel-group remotegrp type IPSec_rahostname(config)# tunnel-group remotegrp generalhostname(config-general)# default-group-policy remotegrphostname(config-general)# strip-realmRelated Commandshostname(config-general)
subject-name (crypto ca certificate map)
To indicate that rule entry is applied to the subject DN of the IPSec peer certificate, use the subject-name command in CA certificate map configuration mode. To remove an subject-name, use the no form of the command.
subject-name [attr tag] eq | ne |co | nc string
no subject-name [attr tag] eq | ne |co | nc string
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Crypto ca certificate map configuration
•
•
•
•
—
Command History
Examples
The following example enters the CA certificate map mode for certificate map 1 and creates a rule entry indicating that the Organization attribute of the certificate subject name must be equal to Central.
hostname(config)# crypto ca certificate map 1hostname(ca-certificate-map)# subject-name attr o eq centralhostname(ca-certificate-map)# exitRelated Commands
subject-name (crypto ca trustpoint)
To include the indicated subject DN in the certificate during enrollment, use the subject-name command in crypto ca trustpoint configuration mode. This is the person or system that uses the certificate. To restore the default setting, use the no form of the command.
subject-name X.500_name
no subject-name
Syntax Description
X.500_name
Defines the X.500 distinguished name, for example: cn=crl,ou=certs,o=CAName,c=US. The maximum length is 1K characters (effectively unbounded).
Defaults
The default setting is not to include the subject name.
Command Modes
The following table shows the modes in which you can enter the command:
Crypto ca trustpoint configuration
•
•
•
—
—
Command History
Examples
The following example enters crypto ca trustpoint configuration mode for trustpoint central, and sets up automatic enrollment at the URL https//:frog.phoobin.com and includes the subject DN OU tiedye.com in the the enrollment request for trustpoint central:
hostname(config)# crypto ca trustpoint centralhostname(ca-trustpoint)# enrollment url http://frog.phoobin.com/hostname(ca-trustpoint)# subject-name ou=tiedye.comhostname(ca-trustpoint)#Related Commands
summary-address
To create aggregate addresses for OSPF, use the summary-address command in router configuration mode. To remove the summary address or specific summary address options, use the no form of this command.
summary-address addr mask [not-advertise] [tag tag_value]
no summary-address addr mask [not-advertise] [tag tag_value]
Syntax Description
Defaults
The defaults are as follows:
•
•
Command Modes
The following table shows the modes in which you can enter the command:
Router configuration
•
—
•
—
—
Command History
Usage Guidelines
Routes learned from other routing protocols can be summarized. Using this command for OSPF causes an OSPF Autonomous System Boundary Router (ASBR) to advertise one external route as an aggregate for all redistributed routes that are covered by the address. This command summarizes only routes from other routing protocols that are being redistributed into OSPF. Use the area range command for route summarization between OSPF areas.
To remove a summary-address command from the configuration, use the no form of the command without specifying any of the optional keywords or arguments. To remove an option from a summary command in the configuration, use the no form of the command with the options that you want removed. See the "Examples" section for more information.
Examples
The following example configures route summarization with a tag set to 3:
hostname(config-router)# summary-address 1.1.0.0 255.255.0.0 tag 3hostname(config-router)#The following example shows how to use the no form of the summary-address command with an option to set that option back to the default value. In this example, the tag value, set to 3 in the previous example, is removed from the summary-address command.
hostname(config-router)# no summary-address 1.1.0.0 255.255.0.0 tag 3hostname(config-router)#The following example removes the summary-address command from the configuration:
hostname(config-router)# no summary-address 1.1.0.0 255.255.0.0hostname(config-router)#Related Commands
sunrpc-server
To create entries in the SunRPC services table, use the sunrpc-server command in global configuration mode. To remove SunRPC services table entries from the configuration, use the no form of this command.
sunrpc-server ifc_name ip_addr mask service service_type protocol [tcp | udp] port port [- port ] timeout hh:mm:ss
no sunrpc-server ifc_name ip_addr mask service service_type protocol [tcp | udp] port port [- port] timeout hh:mm:ss
no sunrpc-server active service service_type server ip_addr
Syntax Description
Defaults
No default behavior or values.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The SunRPC services table is used to allow SunRPC traffic through the security appliance based on an established SunRPC session for the duration specified by the timeout.
Examples
The following example shows how to create an SunRPC services table:
hostname(config)# sunrpc-server outside 10.0.0.1 255.0.0.0 service 100003 protocol TCP port 111 timeout 0:11:00hostname(config)# sunrpc-server outside 10.0.0.1 255.0.0.0 service 100005 protocol TCP port 111 timeout 0:11:00Related Commands
support-user-cert-validation
To validate a remote user certificate based on the current trustpoint, provided that this trustpoint is authenticated to the CA that issued the remote certificate, use the support-user-cert-validation command in crypto ca trustpoint configuration mode. To restore the default setting, use the no form of the command.
support-user-cert-validation
no support-user-cert-validation
Syntax Description
Defaults
The default setting is to support user certificate validation.
Command Modes
The following table shows the modes in which you can enter the command:
Crypto ca trustpoint configuration
•
•
•
•
•
Command History
Usage Guidelines
The security appliance can have two trustpoints with the same CA resulting in two different identity certificates from the same CA. This option is automatically disabled if the trustpoint is authenticated to a CA that is already associated with another trustpoint that has enabled this feature. This prevents ambiguity in the choice of path-validation parameters. If the user attempts to activate this feature on a trustpoint that has been authenticated to a CA already associated with another trustpoint that has enabled this feature, the action is not permitted. No two trustpoints can have this setting enabled and be authenticated to the same CA.
Examples
The following example enters crypto ca trustpoint configuration mode for trustpoint central, and enables the trustpoint central to accept user validation:
hostname(config)# crypto ca trustpoint centralhostname(ca-trustpoint)# support-user-cert-validationhostname(ca-trustpoint)#Related Commands
crypto ca trustpoint
Enters trustpoint configuration mode.
default enrollment
Returns enrollment parameters to their defaults.
syn-data
To allow or drop SYN packets with data, use the syn-data command in tcp-map configuration mode. To remove this specification, use the no form of this command.
syn-data {allow | drop}
no syn-data {allow | drop}
Syntax Description
Defaults
Packets with SYN data are allowed by default.
Command Modes
The following table shows the modes in which you can enter the command:
Tcp-map configuration
•
•
•
•
—
Command History
Usage Guidelines
The tcp-map command is used along with the Modular Policy Framework infrastructure. Define the class of traffic using the class-map command and customize the TCP inspection with tcp-map commands. Apply the new TCP map using the policy-map command. Activate TCP inspection with service-policy commands.
Use the tcp-map command to enter tcp-map configuration mode. Use the syn-data command in tcp-map configuration mode to drop packets with data in SYN packets.
According to the TCP specification, TCP implementations are required to accept data contained in a SYN packet. Because this is a subtle and obscure point, some implementations may not handle this correctly. To avoid any vulnerabilities to insertion attacks involving incorrect end-system implementations, you may choose to drop packets with data in SYN packets.
Examples
The following example shows how to drop SYN packets with data on all TCP flows:
hostname(config)# access-list TCP extended permit tcp any anyhostname(config)# tcp-map tmaphostname(config-tcp-map)# syn-data drophostname(config)# class-map cmaphostname(config-cmap)# match access-list TCPhostname(config)# policy-map pmaphostname(config-pmap)# class cmaphostname(config-pmap)# set connection advanced-options tmaphostname(config)# service-policy pmap globalRelated Commands
sysopt connection permit-ipsec
For traffic that enters the security appliance through an IPSec tunnel and is then decrypted, use the sysopt connection permit-ipsec command in global configuration mode to allow the traffic to bypass interface access lists. Group policy and per-user authorization access lists still apply to the traffic. To disable this feature, use the no form of this command.
sysopt connection permit-ipsec
no sysopt connection permit-ipsec
Syntax Description
This command has no arguments or keywords.
Defaults
This feature is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
—
—
Command History
7.0(1)
This command is now enabled by default. Also, only interface access lists are bypassed; group policy or per-user access lists remain in force.
Usage Guidelines
You might want to bypass interface access lists for decrypted traffic to simplify configuration and to maximize the security appliance performance. If you disable this feature, you must apply an access list to the ingress interface that permits decrypted IPSec packets from all IPSec peers (see the the access-list and access-group commands).
Examples
The following example lets IPSec traffic bypass interface access lists:
hostname(config)# sysopt connection permit-ipsecRelated Commands
sysopt connection tcpmss
To ensure that the maximum TCP segment size does not exceed the value you set and that the maximum is not less than a specified size, use the sysopt connection tcpmss command in global configuration mode. To restore the default setting, use the no form of this command.
sysopt connection tcpmss [minimum] bytes
no sysopt connection tcpmss [minimum] [bytes]
Syntax Description
Defaults
The default maximum value is 1380 bytes. The minimum feature is disabled by default (set to 0).
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Both the host and the server can set the maximum segment size when they first establish a connection. If either maximum exceeds the value you set with the sysopt connection tcpmss command, then the security appliance overrides the maximum and inserts the value you set. If either maximum is less than the value you set with the sysopt connection tcpmss minimum command, then the security appliance overrides the maximum and inserts the "minimum" value you set (the minimum value is actually the smallest maximum allowed). For example, if you set a maximum size of 1200 bytes and a minimum size of 400 bytes, when a host requests a maximum size of 1300 bytes, then the security appliance alters the packet to request 1200 bytes (the maximum). If another host requests a maximum value of 300 bytes, then the security appliance alters the packet to request 400 bytes (the minimum).
The default of 1380 bytes allows room for header information so that the total packet size does not exceed 1500 bytes, which is the default MTU for Ethernet. See the following calculation:
1380 data + 20 TCP + 20 IP + 24 AH + 24 ESP_CIPHER + 12 ESP_AUTH + 20 IP = 1500 bytes
If the host or server does not request a maximum segment size, the security appliance assumes that the RFC 793 default value of 536 bytes is in effect.
If you set the maximum size to be greater than 1380, packets might become fragmented, depending on the MTU size (which is 1500 by default). Large numbers of fragments can impact the performance of the security appliance when it uses the Frag Guard feature. Setting the minimum size prevents the TCP server from sending many small TCP data packets to the client and impacting the performance of the server and the network.
Note
Examples
The following example sets the maximum size to 1200 and the minimum to 400:
hostname(config)# sysopt connection tcpmss 1200hostname(config)# sysopt connection tcpmss minimum 400Related Commands
sysopt connection timewait
To force each TCP connection to linger in a shortened TIME_WAIT state of at least 15 seconds after the final normal TCP close-down sequence, use the sysopt connection timewait command in global configuration mode. To disable this feature, use the no form of this command. You might want to use this feature if an end host application default TCP terminating sequence is a simultaneous close.
sysopt connection timewait
Syntax Description
This command has no arguments or keywords.
Defaults
This feature is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
The default behavior of the security appliance is to track the shutdown sequence and release the connection after two FINs and the ACK of the last FIN segment. This quick release heuristic enables the security appliance to sustain a high connection rate, based on the most common closing sequence, known as the normal close sequence. However, in a simultaneous close, both ends of the transaction initiate the closing sequence, as opposed to the normal close sequence where one end closes and the other end acknowledges prior to initiating its own closing sequence (see RFC 793). Thus, in a simultaneous close, the quick release forces one side of the connection to linger in the CLOSING state. Having many sockets in the CLOSING state can degrade the performance of an end host. For example, some WinSock mainframe clients are known to exhibit this behavior and degrade the performance of the mainframe server. Using the sysopt connection timewait command creates a window for the simultaneous close down sequence to complete.
Examples
The following example enables the timewait feature:
hostname(config)# sysopt connection timewaitRelated Commands
sysopt nodnsalias
To disable DNS inspection that alters the DNS A record address when you use the alias command, use the sysopt nodnsalias command in global configuration mode. To disable this feature, use the no form of this command. You might want to disable DNS application inspection if you want the alias command to perform only NAT, and DNS packet alteration is undesirable.
sysopt nodnsalias {inbound | outbound}
no sysopt nodnsalias {inbound | outbound}
Syntax Description
Defaults
This feature is disabled by default (DNS record address alteration is enabled).
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
—
•
•
—
Command History
Usage Guidelines
The alias command performs NAT and DNS A record address alteration. In some cases, you might want to disable the DNS record alteration.
Examples
The following example disables the DNS address alteration for inbound packets:
hostname(config)# sysopt nodnsalias inboundRelated Commands
sysopt noproxyarp
To disable proxy ARP for NAT global addresses on an interface, use the sysopt noproxyarp command in global configuration mode. To reenable proxy ARP for global addresses, use the no form of this command.
sysopt noproxyarp interface_name
no sysopt noproxyarp interface_name
Syntax Description
Defaults
Proxy ARP for global addresses is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
In rare circumstances, you might want to disable proxy ARP for global addresses.
When a host sends IP traffic to another device on the same Ethernet network, the host needs to know the MAC address of the device. ARP is a Layer 2 protocol that resolves an IP address to a MAC address. A host sends an ARP request asking "Who is this IP address?" The device owning the IP address replies, "I own that IP address; here is my MAC address."
Proxy ARP is when a device responds to an ARP request with its own MAC address, even though the device does not own the IP address. The security appliance uses proxy ARP when you configure NAT and specify a global address that is on the same network as the security appliance interface. The only way traffic can reach the hosts is if the security appliance uses proxy ARP to claim that the security appliance MAC address is assigned to destination global addresses.
Examples
The following example disables proxy ARP on the inside interface:
hostname(config)# sysopt noproxyarp insideRelated Commands
sysopt radius ignore-secret
To ignore the authentication key in RADIUS accounting responses, use the sysopt radius ignore-secret command in global configuration mode. To disable this feature, use the no form of this command. You might need to ignore the key for compatibility with some RADIUS servers.
sysopt radius ignore-secret
no sysopt radius ignore-secret
Syntax Description
This command has no arguments or keywords.
Defaults
This feature is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
Some RADIUS servers fail to include the key in the authenticator hash within the accounting acknowledgment response. This usage caveat can cause the security appliance to continually retransmit the accounting request. Use the sysopt radius ignore-secret command to ignore the key in these acknowledgments, thus avoiding the retransmit problem. (The key identified here is the same one you set with the aaa-server host command.)
Examples
The following example ignores the authentication key in accounting responses:
hostname(config)# sysopt radius ignore-secretRelated Commands
aaa-server host
Identifies a AAA server.
clear configure sysopt
Clears the sysopt command configuration.
show running-config sysopt
Shows the sysopt command configuration.
sysopt uauth allow-http-cache
To let the web browser supply a username and password from its cache when it reauthenticates with the virtual HTTP server on the security appliance (see the virtual http command), use the sysopt uauth allow-http-cache command in global configuration mode. If you do not allow the HTTP cache, then after your authentication session times out, the next time you connect to the virtual HTTP server, you are prompted again for your username and password. To disable this feature, use the no form of this command.
sysopt uauth allow-http-cache
no sysopt uauth allow-http-cache
Syntax Description
This command has no arguments or keywords.
Defaults
This feature is disabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Examples
The following example allows the HTTP cache to be used:
hostname(config)# sysopt uauth allow-http-cacheRelated Commands
